ShinyHunters Claims Responsibility for Ernst & Young Data Breach
Summary
EY reported that attackers downloaded client tax documents from a third-party service management platform between March 28 and April 12. ShinyHunters later claimed responsibility and threatened to release the data.
Key points
- EY said attackers downloaded client tax documents submitted in support tickets through a third-party service management platform between March 28 and April 12.
- The compromised information included names, addresses, Social Security numbers, account and payment card numbers, and other tax-filing data.
- EY did not disclose the number of potentially affected individuals or identify the attackers.
- ShinyHunters claimed responsibility and threatened to release the stolen data if EY did not make contact by July 31.
- EY is offering potentially affected individuals 24 months of credit monitoring, identity monitoring, and identity restoration services.
Article Details
- Victim Organization
- Ernst & Young
- Incident Type
- Data breach involving the theft of tax-related client documents from a third-party service management platform.
- Data Types Exposed
- Client names
- Addresses
- Social Security numbers
- Account numbers
- Credit and debit card numbers
- Other information used for tax filings
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Tax-related documents included in support tickets were downloaded. Ernst & Young is providing potentially impacted individuals with 24 months of credit monitoring, identity monitoring, and identity restoration services.
- Ransom Or Extortion
- ShinyHunters added Ernst & Young to its Tor-based leak site and threatened to release the stolen data if the company did not make contact by July 31. No ransom amount or payment demand is reported.
- Claim Status
- confirmed