InfoSecBulletin Cybersecurity for mankind
ShinyHunters has publicly claimed responsibility for the Ernst & Young (EY) data breach. The group posted a message on their dark web site. It says they will release all stolen data by July 31, 2026, unless EY talks to them before the mentioned date.
EY shared details about the incident earlier this month. They noticed strange activity on April 23, 2026, in an IT system used by their staff for tax client support.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
An investigation showed that a unauthorized person got into the platform from March 28 to April 12, 2026, and downloaded documents from many EY clients.
EY sent letters to regulators like the Attorneys General of California and Texas to report a problem. They confirmed that at least 1,366 people in several US states are affected, but the number is likely much higher due to the firm’s worldwide clients.
ShinyHunters’ Extortion Claim
Until this week, no threat actor had claimed the attack, and EY had not disclosed how intruders breached the third-party platform. That changed when ShinyHunters listed EY on its leak site alongside other new victims, including RingCentral and Brinks Home, asserting the intrusion originated from a supply-chain attack that yielded credentials to EY’s internal systems.
EY Data Breach Claimed by ShinyHunters
The group’s leak-site notice, updated July 27, 2026, warns, “This is a final warning to reach out by 31 July 2026 before we leak along with several ongoing (digital) problems” if EY fails to respond to their contact attempts.
This plan is similar to what ShinyHunters has done before in their attacks on Instructure, Charter Communications, and McGraw Hill. They took advantage of SaaS platforms, SSO credentials, and vishing attacks to steal a lot of data and then asked for ransom.
ShinyHunters has become one of the biggest extortion groups in 2026. They run a special leak site and often take advantage of weak points in other companies instead of breaking into networks directly.
While puhlishing the report, EY has not confirmed ShinyHunters’ specific claims or responded publicly to the July 31 deadline, and no stolen data has yet appeared on underground forums.
