ShinyHunters Claims Responsibility for Ernst & Young Data Breach

The ShinyHunters extortion gang has claimed responsibility for a data breach at Ernst & Young, stating they obtained access through a supply-chain attack. Ernst & Young disclosed the breach earlier this month, revealing that a third-party support ticket system used by its IT personnel was compromised, resulting in the theft of support tickets that may contain client tax information. The company detected unusual activity on April 23, indicating that the attacker accessed the platform between March 28 and April 12, during which multiple documents were downloaded.

In its breach notification, Ernst & Young explained that the compromised system was utilized for IT support related to tax work for clients. The notification specified that the stolen documents included personal and financial information relevant to tax filings. However, the company has not disclosed the name of the compromised support system, the specific types of information exposed, or the number of individuals affected.

Initially, no ransomware or data extortion group had claimed responsibility for the breach. However, ShinyHunters has since added Ernst & Young to its data leak site, asserting that it conducted the attack and threatening to release the stolen data if the company does not reach out by July 31, 2026. The group claimed to BleepingComputer that they acquired EY credentials through a supply-chain attack, which allowed them to breach Ernst & Young's Jira, GitHub, and Azure environments.

The attackers did not identify the third party involved or specify the data that was stolen, but they claimed that the information acknowledged by Ernst & Young as compromised was part of a larger set of exposed data. BleepingComputer has not been able to independently verify these claims, and Ernst & Young has not confirmed ShinyHunters' involvement in the attack.

Further inquiries were made to Ernst & Young regarding the identity of the compromised support system and the number of individuals affected by the breach. The company previously stated that it had secured its systems, eliminated unauthorized access, and notified federal law enforcement. Affected clients are being offered 24 months of identity monitoring and restoration services through Experian. Security experts note that a significant portion of successful attacks go undetected, emphasizing the importance of robust security measures.