The cyberattack involving Ernst & Young (EY) has entered a new phase after the ShinyHunters extortion group claimed responsibility for the intrusion, alleging that it stole data from the third-party support ticket platform used by the global professional services firm. While EY has acknowledged the underlying breach, the company has not confirmed the group's claims, and no leaked data has been independently verified at the time of writing.
The development comes weeks after EY disclosed that an unauthorized party had accessed a third-party support ticket platform used by its IT teams between March 28 and April 12, 2026, potentially exposing documents associated with client tax preparation. The firm had previously informed affected customers that files stored within the support environment could contain personal and financial information submitted through IT support requests, along with documents related to tax services.
According to breach notifications filed with several U.S. state regulators, the exposed records may include sensitive information such as client names, addresses, Social Security numbers, financial account details, payment card information, and other tax-related records. However, EY has not disclosed how many individuals were affected, whether customers outside the United States were impacted, or the identity of the third-party support platform involved in the incident.
The latest development centers on ShinyHunters' public assertion that it carried out the attack and obtained data from the compromised environment. The group has reportedly threatened to publish the allegedly stolen information if its demands are not met. Despite these claims, EY has neither attributed the incident to ShinyHunters nor confirmed that the attackers possess company or client data. Security researchers also note that threat actors have, on occasion, exaggerated or misrepresented claims to increase pressure on victims, making independent verification essential before drawing conclusions.
EY has stated that it immediately activated its incident response procedures after detecting suspicious activity and engaged an independent cybersecurity firm to assist with forensic analysis and remediation. The company says it has contained the unauthorized access, secured the affected environment, and notified relevant federal law enforcement authorities. It also maintains that its investigation has found no evidence that the compromised information has been misused or that individual clients were specifically targeted.
As part of its response, EY continues to provide eligible affected customers with 24 months of complimentary Experian identity restoration, identity monitoring, and credit monitoring services, with enrollment available through October 31, 2026.
Although the breach itself has already been disclosed, the emergence of an alleged threat actor highlights how cyber incidents often evolve long after the initial discovery. Public claims made by ransomware or extortion groups can influence regulatory scrutiny, customer communication, and incident response strategies, even before their assertions are independently verified.
The incident also reinforces the importance of third-party risk management. Organizations that rely on external platforms to process or store sensitive customer information should continuously assess vendor security controls, restrict unnecessary access to confidential data, and maintain comprehensive monitoring and incident response capabilities to reduce the impact of supply chain compromises.
