CTIPilot

Ernst & Young third-party ITSM breach

incident · incident:ey-third-party-itsm-breach-2026

Unauthorized access (2026-03-28 to 04-12, detected 2026-04-23) to a third-party IT service-management/support-ticket platform used by Ernst & Young LLP's tax practice; documents containing client tax/financial data were downloaded. Disclosed via California/Vermont AG breach notifications filed 2026-07-15; EY has not named the platform, the access vector, or the affected count (California OAG, BleepingComputer, CyberInsider, 2026-07-15/17). ShinyHunters claimed responsibility on its leak site on 2026-07-27, asserting the credentials came from a supply-chain attack and reached EY's Jira, GitHub and Azure environments; EY has not confirmed the attribution and the claim is unverified (BleepingComputer, 2026-07-27).

Coverage timeline
1
first 2026-07-19 → last 2026-07-19
Peak priority
notable
1 notable
Sources cited
4
3 hosts
Sections touched
1
active-threats
Co-occurring entities
1
see Co-occurring entities below
ATT&CK techniques
3
pinned v19.2 · see below

Hunting pivots

ATT&CK techniques
T1078T1199T1213
Tags
data-breachidentitysupply-chain

ATT&CK techniques

3 techniques observed across 1 entry, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-19/ernst-young-third-party-itsm-platform-breach-client-tax-data · ATT&CK page ↗

T1199Trusted Relationship×1

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Evidence: 2026-07-19/ernst-young-third-party-itsm-platform-breach-client-tax-data · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-19/ernst-young-third-party-itsm-platform-breach-client-tax-data · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-19/ernst-young-third-party-itsm-platform-breach-client-tax-data · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-19/ernst-young-third-party-itsm-platform-breach-client-tax-data · ATT&CK page ↗

Collection TA0009

T1213Data from Information Repositories×1

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).

Evidence: 2026-07-19/ernst-young-third-party-itsm-platform-breach-client-tax-data · ATT&CK page ↗

Story timeline

  1. 2026-07-19Ernst & Young discloses a breach of a third-party IT support-ticket platform used by its tax practice, exposing client tax and financial documents
    active-threatsEY discloses client tax-data exposure after a third-party ITSM support-ticket platform was breached

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

attributed to

Where this entity is cited

  • active-threats1

Source distribution

  • bleepingcomputer.com2 (50%)
  • cyberinsider.com1 (25%)
  • oag.ca.gov1 (25%)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

All cited sources (4)

Entries about Ernst & Young third-party ITSM breach (1)

2026-07-19 · view entry permalink →

NOTABLEupdatedNATOA2

Ernst & Young discloses a breach of a third-party IT support-ticket platform used by its tax practice, exposing client tax and financial documents

Ernst & Young LLP (EY), one of the "Big Four" audit/tax/consulting networks, filed data-breach notifications with the California and Vermont Attorneys General on 2026-07-15 after determining that an unauthorized third party had accessed a third-party IT service-management (ITSM) platform used by its tax practice (California OAG, 2026-07-15). EY detected anomalous activity on 2026-04-23 and an external forensics firm concluded that the intruder had access "between March 28 and April 12 and downloaded multiple documents" belonging to multiple tax clients, a roughly two-week access window, detected about eleven days after the intruder's access ended (BleepingComputer, 2026-07-17). The platform manages IT support tickets for tax-engagement work, and "support tickets submitted through the platform may include documents containing client tax information", the financial information used to prepare tax filings (CyberInsider, 2026-07-17); the regulatory notice letter itself redacts the specific data elements involved. EY has not disclosed the initial-access vector, named the compromised third-party platform, stated how many individuals are affected, or said whether non-US clients are impacted; no extortion or ransomware group has claimed the intrusion, and EY is offering 24 months of identity monitoring to affected individuals (BleepingComputer, 2026-07-17).

an unauthorized third party had accessed the said platform between March 28 and April 12 and downloaded multiple documents

BleepingComputer 2026-07-17

Support tickets submitted through the platform may include documents containing client tax information.

CyberInsider 2026-07-17

Sample of Notice: EY Notice Letter US General.pdf Organization Name: Ernst & Young LLP Date(s) of Breach (if known): Saturday, March 28, 2026 Thursday, April 23, 2026

California Office of the Attorney General (breach-notification filing) 2026-07-15

The threat actors claimed to BleepingComputer that EY credentials were obtained through a supply-chain attack and used to breach the company. These stolen credentials allegedly allowed them to breach Ernst & Young's Jira, GitHub, and Azure environments.

BleepingComputer has no way to verify the threat actor's claims independently, and Ernst & Young has not confirmed that ShinyHunters was behind the attack.

BleepingComputer 2026-07-17
Updaterun 2026-07-28T0409Z-intelentitiesevidencesourcestagstechniquesbody

The Ernst & Young third-party ITSM breach now has a claimed author. ShinyHunters added EY to its data-leak site on 2026-07-27, claiming it carried out the attack and threatening to publish the stolen data unless the firm makes contact by 2026-07-31 (BleepingComputer, 2026-07-27). At first coverage no group had claimed the intrusion.

The substantive delta is the claimed scope. The group told BleepingComputer that EY credentials "were obtained through a supply-chain attack and used to breach the company", and that those credentials "allegedly allowed them to breach Ernst & Young's Jira, GitHub, and Azure environments", issue tracking, source control and a cloud control plane, none of which appears in EY's own disclosure, which described support tickets that may contain client tax documents. The group declined to name the compromised third party or say what was taken, while asserting that the data EY acknowledged was exposed along with more (BleepingComputer, 2026-07-27). None of this is confirmed: BleepingComputer states it "has no way to verify the threat actor's claims independently, and Ernst & Young has not confirmed that ShinyHunters was behind the attack" (BleepingComputer, 2026-07-27). The report also names Experian as the provider of the 24 months of identity monitoring EY is offering affected clients, which the original coverage recorded without naming.

Triage: an intrusion of this shape presents in the downstream systems as valid-credential access, not as exploitation, successful authentications by a support-platform service account or an integration identity, arriving in the platform's normal window and often from plausible infrastructure. The discriminator is not the authentication itself but its reach: a support integration that has historically only ever read issue metadata suddenly enumerating repositories, cloning at volume, or touching cloud control-plane APIs is the deviation, and the baseline for "what this identity normally does" is the control that makes it visible.

incident19 Jul 04:25Zmulti-sourceOpen finding ↗
Sources: California Office of the Attorney General (breach-notification filing) · BleepingComputer · CyberInsider