Ernst & Young Reports Third-Party Data Breach

Originally published on CyberNetSec.

Executive Summary

Global professional services firm Ernst & Young (EY) has disclosed a data breach resulting from the compromise of an unnamed third-party IT support provider. A threat intelligence report from Check Point Research on July 20, 2026, confirmed that unauthorized actors gained access to the support platform. This access may have exposed sensitive data belonging to EY's clients and employees, which was contained within IT support tickets submitted to the provider. The incident is a stark reminder of the significant risks inherent in the digital supply chain, where a vulnerability in a single vendor can lead to a data breach at a major global enterprise. An investigation into the full scope of the breach is currently underway.

---

Threat Overview

This incident is a classic supply chain attack, where attackers targeted a smaller, potentially less secure, third-party vendor to gain access to the data of a much larger and more valuable target: EY. IT support platforms are an attractive target for attackers because they are a repository of sensitive information.

When employees or clients submit a support ticket, they often include detailed descriptions of their issues, screenshots, log files, and data exports. This information can inadvertently contain:

• User credentials
• Client financial or tax data
• Personally Identifiable Information (PII)
• Details about internal network configurations and software

By compromising the support platform, attackers gain a treasure trove of sensitive data and reconnaissance information that can be used for further attacks against EY or its clients.

Technical Analysis

The specific vector for the compromise of the third-party provider was not disclosed. However, common TTPs for this type of attack include:

• Exploiting a vulnerability in the support platform's software.
• Stealing credentials from an employee of the third-party provider via phishing.
• Abusing misconfigurations in the platform's cloud environment.

The relevant MITRE ATT&CK techniques for this scenario are:

• T1199 - Trusted Relationship: The attacker abused the trusted relationship between EY and its IT support vendor.
• T1195 - Supply Chain Compromise: The core of the attack, targeting a service provider to access its customer's data.
• T1552 - Unsecured Credentials: Sensitive data, including credentials, may have been stored insecurely within the support tickets.

Impact Assessment

The potential impact on EY and its clients is significant:

• Client Data Exposure: The breach could expose highly sensitive financial, tax, and proprietary business information of EY's clients, which include many of the world's largest companies.
• Regulatory and Legal Consequences: EY faces significant regulatory scrutiny under frameworks like GDPR. The breach could lead to substantial fines, litigation from clients, and damage to its brand.
• Further Attacks: Information gleaned from the support tickets, such as internal system details or credentials, could be used to launch more targeted and sophisticated attacks directly against EY or its clients.
• Loss of Trust: As a firm that advises clients on risk management, a data breach of this nature is particularly damaging to EY's reputation and credibility.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were provided in the source articles.

Detection & Response

For EY, the response involves a full-scale investigation, including forensics on the third-party platform and assessing which clients' data was exposed. For clients of EY, the following steps are prudent:

1. Seek Clarification: Request detailed information from EY regarding the nature of the breach and whether your organization's data was impacted.
2. Review Data Shared: Conduct an internal review of what kind of data your employees may have shared through IT support tickets.
3. Heightened Monitoring: Increase monitoring for phishing campaigns targeting your employees that might leverage information stolen from the breach. Be alert for any unusual activity related to accounts or systems that may have been mentioned in support tickets.

Mitigation

This breach underscores the critical importance of a robust third-party risk management program.

1. Thorough Vendor Vetting: Before engaging any third-party provider, especially one that will handle sensitive data, conduct a thorough security assessment. Review their security certifications (e.g., SOC 2, ISO 27001) and incident response capabilities. (M0948 - Third-party Service Dependencies)
2. Data Minimization and Masking: Establish and enforce strict policies on what information can be shared in support tickets. Employees should be trained to never include passwords, PII, or other sensitive data. Where possible, use tools that automatically mask or redact sensitive information from logs and screenshots before they are uploaded. (M1041 - Encrypt Sensitive Information)
3. Contractual Obligations: Ensure that contracts with third-party providers include strong security clauses, specific breach notification timelines (e.g., within 24 hours of discovery), and liability for security failures.
4. Zero Trust Architecture: Implement a Zero Trust security model where no user or system is trusted by default, regardless of whether they are internal or external. Access to data should be strictly controlled and continuously verified. (M1035 - Limit Access to Resource Over Network)