Loading story…
Ernst & Young (EY) is facing a claimed extortion campaign from ShinyHunters, which says it stole employee credentials and sensitive files and has threatened to leak the data unless the firm makes contact by July 31. A posting attributed to the group warned of both public data exposure and additional digital disruption, while identifying ey.com as the affected domain.
The claim follows EY's earlier disclosure that attackers gained unauthorized access to a third-party IT service management platform between March 28 and April 12, 2026, with anomalous activity detected on April 23. EY said documents linked to numerous tax clients were downloaded from support tickets containing tax records and personal and financial data, including names, addresses, Social Security numbers, and payment card details. The firm notified regulators in California and Texas, said at least 1,366 residents across multiple U.S. states were affected, and offered two years of credit monitoring and identity restoration; EY has not confirmed ShinyHunters' involvement, and no leaked data had been observed on underground forums at the time of reporting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
EY notified regulators including the California and Texas Attorneys General about the incident. The company confirmed at least 1,366 affected residents across multiple U.S. states and offered two years of credit monitoring and identity restoration services.
ShinyHunters publicly claimed responsibility for the EY breach and threatened to release stolen data unless EY negotiated by July 31, 2026. The group alleged it stole employee credentials and sensitive files, though EY had not confirmed the gang's claims.
A breach listing attributed to ShinyHunters reported Ernst & Young as a victim on July 27, 2026, identifying ey.com as the affected domain. The listing stated the breach occurred at 11:10 UTC and was discovered at 12:58 UTC.
EY reported that anomalous activity related to the compromised IT service management platform was detected on April 23, 2026. The company later tied the activity to unauthorized access affecting support-ticket data.
EY said the unauthorized access to the IT service management platform continued until April 12, 2026. During the incident, documents tied to numerous tax clients were downloaded.
EY disclosed that unauthorized access to an IT service management platform began on March 28, 2026. ShinyHunters later alleged the intrusion involved a supply-chain compromise of a third-party IT support platform.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcesecurityaffairs.com
Open sourcesecurityweek.com
Open sourcebusinessinsurance.com
Open sourcecybersecuritynews.com
Open sourcehookphish.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ernst & Young (EY) disclosed a data breach after attackers gained unauthorized access to a third-party IT support and ticketing platform used by EY personnel supporting tax-related client work. EY said the intruders accessed the system between **March 28 and April 12, 2026**, downloaded multiple documents, and exposed personal and financial information used for tax preparation, including data tied to some individuals’ investment holdings with EY institutional clients. The firm detected anomalous activity on **April 23**, launched an investigation with external cybersecurity experts, secured affected systems, and notified federal law enforcement. EY has not disclosed the identity of the third-party vendor, the number of affected individuals, the attack method, or any attribution to a threat actor. The company said it has not found evidence that the stolen information has been misused or that specific individuals were deliberately targeted, and began notifying affected people on **July 13**. EY also filed breach notifications with the California Attorney General and is offering eligible individuals **24 months** of Experian identity monitoring and restoration services.
Jul 27, 2026
ShinyHunters publicly leaked data from **Moody Bible Institute** after a "pay or leak" extortion attempt, exposing more than **2.3 million unique email addresses** along with names, physical addresses, phone numbers, dates of birth, and other personal details tied to donors, supporters, students, and alumni. Moody said it brought in internal and external cybersecurity specialists to investigate the breach and respond to the disclosure. The same threat activity has also been linked to attacks on **Oracle PeopleSoft** deployments, with the **National Association of Insurance Commissioners (NAIC)** saying attackers exploited a **zero-day** flaw to gain temporary access to part of its IT environment and steal confidential financial reporting, credit rating agency, and technical data that was later published online. NAIC said the intrusion was part of a broader campaign affecting multiple organizations after ShinyHunters claimed compromises of more than 100 PeopleSoft installations worldwide; the organization said no personally identifiable information or payment account data was involved, remediated affected systems with outside experts, and said the **FBI** was investigating.
Jul 10, 2026
**Crunchbase** confirmed a cybersecurity incident after the **ShinyHunters** cybercrime group claimed it stole **over 2 million personal records**. ShinyHunters reportedly posted a **402 MB compressed archive** online after an extortion attempt failed, and Crunchbase stated the threat actor **exfiltrated certain documents from its corporate network**. Crunchbase said business operations were not disrupted, the incident was **contained**, external cybersecurity experts were engaged, and **federal law enforcement** was notified while the company reviews the exposed data to determine required legal notifications. In a separate ShinyHunters-linked extortion case, French crypto tax platform **Waltio** was reported to be facing a ransom threat tied to alleged theft of personal data for **nearly 50,000 users**, including threatened exposure of users’ **2024 tax reports**. Waltio stated its services and production systems remained secure and that **no sensitive banking or crypto access data** was compromised. The activity aligns with ShinyHunters’ established pattern of **data theft and leak-site pressure** when ransom demands are not met.
Jun 29, 2026