ShinyHunters claims Ernst & Young breach, points to supply-chain attack

Key points

• ShinyHunters, an extortion gang, has publicly claimed the Ernst & Young breach first disclosed earlier this month.
• The group listed EY on its leak site and set a payment deadline of 31 July 2026.
• Attackers accessed a third-party IT support ticket system between 28 March and 12 April, with EY detecting unusual activity on 23 April.
• Stolen support tickets may contain personal and financial information used to prepare client tax filings.
• EY is offering affected clients 24 months of identity monitoring through Experian.

ShinyHunters, a data-theft and extortion crew with claims against Ticketmaster and AT&T among others, has added Ernst & Young to its leak site. The group says it broke into the accounting firm through a supplier, not through EY's front door.

EY, one of the Big Four accounting firms, disclosed the breach earlier this month. A third-party support ticket system used by its IT staff was accessed; tickets containing client tax information were taken. We first reported on that disclosure on 17 July in "Ernst & Young Tells Clients Their Tax Data Was Taken From a Support Ticket System".

The intruders were inside the platform from 28 March to 12 April. Unusual activity was spotted on 23 April. EY has not named the compromised system, said how many people were affected, or detailed every category of information exposed.

Who are ShinyHunters?

ShinyHunters steals corporate data and demands payment to keep it off the internet. They don't encrypt files the way traditional ransomware does (malicious software that locks a victim's systems until money is paid). They just threaten to publish what they took.

Working through cloud accounts and developer tools rather than crude email attacks, the crew has built a long record of high-profile thefts.

How did they say they got in?

The group told BleepingComputer that EY credentials were harvested through a supply-chain attack: they broke into a supplier first, then used what they found there to enter EY. Those stolen logins, they claim, opened the door to EY's Jira (a project-tracking tool), its GitHub code repositories, and its Azure cloud environment.

The hackers wouldn't name the supplier or describe exactly what data they took. They say the tax-related documents EY has already acknowledged are part of the haul, along with more that hasn't been disclosed.

EY hasn't confirmed that ShinyHunters is behind the attack. The firm previously said it secured its systems, removed the unauthorised access and notified federal law enforcement.

What was taken, and who is affected?

The leaked tickets were the kind IT staff open when helping tax teams do their work. That means documents can include names, addresses, income figures and sometimes national tax numbers.

Should EY clients be worried?

Clients whose files were caught up in the breach should already have heard from EY or expect to soon. Take the free 24 months of Experian monitoring if it's offered. Watch for tax-themed scam calls and emails: criminals with tax paperwork can make very convincing approaches. Our 25 July story on how scammers are recycling ShinyHunters breach data to power sextortion emails shows exactly how quickly old stolen records find a new use.

The deadline ShinyHunters has set, 31 July 2026, is unusually far off for this kind of extortion. That gives EY time to respond, but it also keeps the threat hanging over the firm for months. Whether that patience signals confidence in what they have or a negotiating tactic worth watching is the real question here.