ShinyHunters claim responsibility for the Ernst & Young data breach

The extortion group ShinyHunters has claimed responsibility for the recently disclosed data breach at auditing and consulting firm Ernst & Young (EY). According to the attackers, they obtained credentials to some of the company's systems through a supply-chain attack.

What is known about the incident

EY itself disclosed the breach earlier this month. According to the company, a third-party support ticketing service used by its IT staff was compromised. That platform handled tickets that could contain documents with clients' tax information.

EY noticed unusual activity on April 23. An investigation found that the attacker had access to the platform from March 28 to April 12 and, during that time, downloaded a number of documents. According to the notification, the stolen files contained personal and financial details of the kind that appear on tax returns or are used when preparing them.

That said, EY did not name the compromised support system, the specific categories of exposed data, or the number of people affected. At the time the incident was disclosed, no group had claimed responsibility for the attack.

ShinyHunters' claims

ShinyHunters has now added Ernst & Young to its data-leak site and threatened to release the allegedly stolen data unless the company contacts the group by July 31, 2026.

In a conversation with BleepingComputer, the attackers claimed that EY's credentials had been obtained through a supply-chain attack and had allowed them to break into Jira, GitHub, and Azure environments. The group declined to name the compromised third-party contractor or to specify exactly what had been stolen, but said it had obtained both the data the company had acknowledged and additional information.

BleepingComputer stresses that it cannot independently verify these claims, and EY itself has not confirmed ShinyHunters' involvement in the attack. The outlet again reached out to the company with questions about whether this group is indeed behind the incident, whether EY had received a ransom demand, which support system was compromised, and how many people were affected.

EY had earlier reported that it had secured its systems, cut off the unauthorized access, and notified federal law enforcement. The company is offering affected clients 24 months of identity monitoring and restoration services through Experian.

Source: Bleeping Computer