# ShinyHunters Claims Ernst & Young Breach — and the Supply Chain Gap That Made It Possible
Tax documents are not like stolen passwords. You can reset a password. You cannot un-file a tax return. When client financial data from one of the Big Four accounting firms ends up in a threat actor's hands — data that might include business structures, executive compensation, foreign holdings, and banking information — the downstream exposure has a very long tail.
That's what's at stake in the Ernst & Young breach, which just got significantly more complicated.
## ShinyHunters Puts EY on the Clock
EY disclosed the breach earlier this month with the controlled language of a company hoping to limit the blast radius: a third-party IT support platform was compromised, support tickets may have contained client tax information, the window ran from March 28 to April 12, and the company detected unusual activity on April 23. Affected clients are getting 24 months of identity monitoring through Experian — the boilerplate remediation that follows nearly every enterprise breach announcement now.
What EY did not do was name the compromised platform, disclose how many clients were affected, or specify what categories of tax data were actually exposed. That information vacuum got filled this week when ShinyHunters added Ernst & Young to its data leak site and set a deadline: contact us by July 31, 2026, or the data goes public.
The group told BleepingComputer it obtained EY credentials through a supply-chain attack — a compromise of the unnamed third-party vendor — and used those credentials to access EY's Jira, GitHub, and Azure environments. If accurate, that's not just a stolen support ticket. That's a threat actor moving laterally through a major enterprise's development infrastructure.
## The Third-Party Blind Spot
The mechanism ShinyHunters is describing — credential theft through a compromised vendor, then lateral movement into primary systems — is the same playbook that has been burned into enterprise security after SolarWinds, Kaseya, and a dozen other incidents. And yet the third-party IT service management platform remains a consistent soft underbelly.
Why? Because IT support platforms sit in an awkward position in the security architecture. They need access to sensitive data to be functional — you can't troubleshoot a tax workflow without seeing the tax data — but they're operated by a vendor, which means their security posture is outside the direct control of the organization trusting them. Large enterprises accept this tradeoff constantly. The assumption is that the vendor handles their side. The assumption is often wrong.
EY's decision not to name the compromised platform is understandable from a legal liability standpoint but is genuinely harmful to the broader security community. If a hundred other professional services firms are using the same IT service management tool, they cannot investigate their own exposure without that information. The silence protects EY's vendor relationship. It does not protect EY's clients or anyone else's.
## ShinyHunters' Professional Services Offensive
ShinyHunters is not a new name. The group has been active since at least 2020 and has claimed breaches at hundreds of organizations. But the recent run of targets tells a story: NAIC through a PeopleSoft breach, Medtronic, Kodak, and now Ernst & Young. These are not targets of opportunity. Professional services firms, medical device companies, and critical infrastructure players hold data that is inherently more valuable for extortion than a retail breach. The data is specific, sensitive, and often cannot be quickly devalued.
The group's technique — supply-chain entry, credential-based lateral movement, public extortion with a hard deadline — has become a polished operational pattern. They are not relying on zero-days. They're relying on the fact that large organizations extend enormous trust to their vendor ecosystem, and that trust is frequently validated without rigorous ongoing monitoring.
## What 26 Days of Undetected Access Means
The timeline is worth sitting with. ShinyHunters allegedly had access from March 28 to April 12 — roughly two weeks of active access. EY detected unusual activity on April 23, eleven days after the attacker had already left. In the gap between March 28 and April 23, whatever was worth taking was taken.
The attacker had access to Jira, GitHub, and Azure, according to their own claims. That's project tracking, source code, and cloud infrastructure. Even if we assume the group's stated targets are partially inflated — threat actors routinely overclaim scope — the combination of IT support ticket data with development environment access represents a significant intelligence haul.
For clients whose information was in those support tickets, the exposure isn't limited to the tax data itself. Support tickets often contain context that would help an attacker impersonate an organization or its executives: system names, internal workflows, the names of EY staff members assigned to specific accounts. That operational context has value that goes well beyond the financial data in the filings.
## What Defenders Should Do Now
For any organization that uses EY for tax work and has reason to believe its data may have been included in a support ticket between late March and mid-April, the first step is not waiting for the notification letter. Contact EY directly and ask whether your engagement is in scope.
For security teams at professional services firms more broadly: your IT service management platform is a high-value target. If it has access to client data — and most of them do — it deserves the same scrutiny you apply to internal systems. That means reviewing what credentials the platform uses, what data it can access, and whether your logging and anomaly detection covers vendor-operated tools the same way it covers internal ones.
The Jira and GitHub claims from ShinyHunters also warrant attention from EY's development teams. Source code repositories and project tracking systems frequently contain credentials, API keys, and internal documentation that outlasts whatever posture review was done when the breach was initially contained.
---
## HackWire Analysis
The EY breach, viewed in isolation, looks like another enterprise supply-chain incident. Viewed against ShinyHunters' recent campaign, it looks like something more deliberate: a methodical targeting of organizations that hold irreplaceable financial and operational data on behalf of their clients.
What's missing from most of the coverage is the asymmetric risk profile of professional services breaches compared to direct enterprise breaches. When a retailer gets breached, the exposed data is typically payment cards and email addresses — high volume, relatively low value per record, and increasingly commoditized on underground markets. When a Big Four accounting firm's IT systems are breached, the exposed data is client tax information: business structures, executive compensation arrangements, international holdings, banking relationships. That data doesn't rotate. It doesn't expire. And it represents the kind of financial intelligence that state actors pay significant sums for, which raises the question of whether pure extortion is the only use case ShinyHunters has in mind.
The second thing that deserves more scrutiny is the deadline mechanism. By setting a July 31 deadline and going public with the listing, ShinyHunters is also signaling to EY's clients: your data may be in our possession, whether or not EY tells you. That's a secondary extortion pressure applied directly to EY's client relationships — a sophisticated move that goes beyond simple ransomware economics.
Professional services firms need to treat their vendor supply chain as an attack surface, not an administrative function. The TPRM (third-party risk management) programs at most large firms still lag far behind the trust those vendors are extended.
— HackWire Editorial
---
## Related Coverage