Ernst & Young Reports Data Breach Following Support System Hack

Ernst & Young (EY), one of the world's largest audit and consulting firms, has notified clients of a data breach. The incident was caused by the compromise of a third-party service that powered the support system used by the company's IT specialists.

What happened

The attackers gained access to a third-party platform for processing technical support tickets. IT department staff at EY used this system to interact with the service provider when resolving technical issues.

The company has begun sending clients notifications about the incident, as required by security breach disclosure rules.

The company's response

EY has confirmed that the third-party solution was compromised and has started notifying the affected parties. Details about the nature of the compromised data, the scope of the incident, and the measures taken to remediate its consequences are currently limited.

Context

Incidents involving the compromise of third-party providers' support and ticketing systems have become an increasingly common attack vector against large organizations in recent years. Such platforms often contain sensitive information about client companies' internal infrastructure, as well as correspondence describing technical problems, which makes them an attractive target for attackers.

EY, a member of the so-called “Big Four” audit firms alongside Deloitte, PwC, and KPMG, serves thousands of corporate clients around the world, including financial institutions and government agencies, which makes breaches like this potentially significant in terms of their consequences for a wide range of counterparties.

Source: Bleeping Computer