ShinyHunters Claim Responsibility for Ernst & Young Breach
Summary
EY disclosed that attackers accessed a third-party support platform and downloaded documents that may contain client tax information. ShinyHunters claims responsibility and alleges a supply-chain attack; EY has not confirmed the gang’s role.
Key points
- EY said an attacker accessed its third-party IT support platform from March 28 to April 12, 2026, and downloaded multiple documents.
- The stolen documents contained personal and financial information included in or used to prepare client tax filings.
- ShinyHunters claims it used credentials obtained through a supply-chain attack to access EY systems, including Jira, GitHub, and Azure; those claims are unverified.
- The gang added EY to its leak site and threatened to release allegedly stolen data unless the company contacted it by July 31, 2026.
- EY has not confirmed ShinyHunters was responsible; the company says it secured its systems, removed unauthorized access, and notified federal law enforcement.
- EY has not disclosed the compromised support system, the specific exposed information, or the number of affected people; affected clients are offered 24 months of identity monitoring and restoration services.
Article Details
- Victim Organization
- Ernst & Young
- Incident Type
- Compromise of a third-party IT service management support-ticket platform, with unauthorized access and document downloads. ShinyHunters claimed the breach involved credentials obtained through a supply-chain attack; that attribution and account is unverified.
- Data Types Exposed
- Personal information
- Financial information
- Client tax information
- Operational Impact
- EY said it detected unusual activity on April 23, found that an attacker accessed the platform between March 28 and April 12 and downloaded multiple documents, secured its systems, removed unauthorized access, and notified federal law enforcement.
- Ransom Or Extortion
- ShinyHunters listed EY on its data leak site and threatened to release allegedly stolen data unless the company contacted the group by July 31, 2026. The article does not confirm that EY received an extortion demand.
- Claim Status
- claimed
MITRE ATT&CK
Threat Actors
Products
AzureThese stolen credentials allegedly allowed them to breach Ernst & Young's Jira, GitHub, and Azure environments.GitHubThese stolen credentials allegedly allowed them to breach Ernst & Young's Jira, GitHub, and Azure environments.JiraThese stolen credentials allegedly allowed them to breach Ernst & Young's Jira, GitHub, and Azure environments.