ShinyHunters claims the Ernst & Young ITSM breach and asserts the stolen third-party credentials reached Jira, GitHub and Azure
UPDATE · originally covered Ernst & Young discloses a breach of a third-party IT support-ticket platform used by its tax practice, exposing client tax and financial documents (2026-07-19)
The Ernst & Young third-party ITSM breach now has a claimed author. ShinyHunters added EY to its data-leak site on 2026-07-27, claiming it carried out the attack and threatening to publish the stolen data unless the firm makes contact by 2026-07-31 (BleepingComputer, 2026-07-27). At first coverage no group had claimed the intrusion.
The substantive delta is the claimed scope. The group told BleepingComputer that EY credentials "were obtained through a supply-chain attack and used to breach the company", and that those credentials "allegedly allowed them to breach Ernst & Young's Jira, GitHub, and Azure environments" — issue tracking, source control and a cloud control plane, none of which appears in EY's own disclosure, which described support tickets that may contain client tax documents. The group declined to name the compromised third party or say what was taken, while asserting that the data EY acknowledged was exposed along with more (BleepingComputer, 2026-07-27). None of this is confirmed: BleepingComputer states it "has no way to verify the threat actor's claims independently, and Ernst & Young has not confirmed that ShinyHunters was behind the attack" (BleepingComputer, 2026-07-27). The report also names Experian as the provider of the 24 months of identity monitoring EY is offering affected clients, which the original coverage recorded without naming.
Triage: an intrusion of this shape presents in the downstream systems as valid-credential access, not as exploitation — successful authentications by a support-platform service account or an integration identity, arriving in the platform's normal window and often from plausible infrastructure. The discriminator is not the authentication itself but its reach: a support integration that has historically only ever read issue metadata suddenly enumerating repositories, cloning at volume, or touching cloud control-plane APIs is the deviation, and the baseline for "what this identity normally does" is the control that makes it visible.
The threat actors claimed to BleepingComputer that EY credentials were obtained through a supply-chain attack and used to breach the company. These stolen credentials allegedly allowed them to breach Ernst & Young's Jira, GitHub, and Azure environments.
BleepingComputer has no way to verify the threat actor's claims independently, and Ernst & Young has not confirmed that ShinyHunters was behind the attack.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1199Trusted Relationship
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
Persistence TA0003
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Privilege Escalation TA0004
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Stealth TA0005
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Sources
Update chain
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.