Originally published on CyberNetSec.
Executive Summary
Global accounting firm Ernst & Young (EY) has fallen victim to a significant data breach orchestrated by the notorious threat group ShinyHunters. The attackers compromised a third-party IT help-desk platform used by EY's tax division, maintaining access for over two weeks. During this dwell time, ShinyHunters exfiltrated a trove of sensitive client data, including Social Security numbers and confidential tax filing information. The group has issued an extortion demand with a deadline of July 31, 2026. This incident serves as a stark example of a supply chain attack, where a less secure third-party vendor becomes the entry point into a major corporation.
Threat Overview
The attack vector was a third-party IT help-desk platform, which acted as a repository for sensitive client information attached to support tickets over time. ShinyHunters gained access to this platform and had persistent access for more than two weeks, allowing them ample time for reconnaissance and data exfiltration. The compromised data is highly sensitive, containing PII and financial details of EY's tax clients. This is a classic extortion scenario where the threat actor's leverage is the public release of confidential data, rather than encryption for impact.
Technical Analysis
The core TTP in this incident is the exploitation of a trusted third-party relationship.
- Initial Access: The attackers compromised the third-party help-desk platform. The exact method is unknown but could involve exploiting a vulnerability in the platform (
T1190 - Exploit Public-Facing Application) or using compromised credentials for a platform administrator (T1078 - Valid Accounts). This represents a compromise of aT1199 - Trusted Relationship. - Persistence: The attackers maintained access for over two weeks, suggesting they created persistent access mechanisms within the help-desk platform or maintained control of a compromised account.
- Collection: The group collected sensitive documents that were stored as attachments within the help-desk ticketing system (
T1530 - Data from Cloud Storage Objectis analogous here). - Exfiltration: Data was exfiltrated from the third-party platform to attacker-controlled infrastructure, likely via
T1567 - Exfiltration Over Web Service.
ShinyHunters is known for this type of attack: breaching services, stealing user data, and then selling it or extorting the company.
Impact Assessment
The impact on EY is multi-faceted and severe. The firm faces significant reputational damage, as clients in the accounting sector expect the highest level of confidentiality. The breach of tax data and Social Security numbers exposes EY to massive potential liability, including regulatory fines from bodies like the SEC and FTC, as well as class-action lawsuits from affected clients. The incident could lead to a loss of clients and revenue. For the individuals whose data was stolen, the risk of identity theft, financial fraud, and targeted phishing attacks is extremely high. The event also forces EY to undertake a costly incident response and re-evaluate its entire third-party risk management program.
IOCs — Directly from Articles
No specific file hashes, IP addresses, or domains were provided in the source articles.
Cyber Observables — Hunting Hints
For organizations using third-party SaaS platforms, hunting for these observables is key:
| Type | Value | Description | Context |
|---|---|---|---|
log_source |
SaaS Audit Logs | Monitor for logins to third-party platforms from unfamiliar IP ranges, countries, or ASNs. | Third-party application logs, SIEM. |
user_account_pattern |
Impossible travel | An account logging in from two geographically distant locations in a short time frame. | IAM logs, SIEM correlation rules. |
api_endpoint |
Bulk download/export | A user account performing a bulk data export or downloading an unusually large number of attachments. | SaaS application audit logs. |
user_account_pattern |
Permission escalation | An existing user account having its permissions elevated, or a new high-privilege account being created. | SaaS application audit logs. |
Detection & Response
Detection:
- Log Integration: Ingest audit logs from all critical third-party SaaS platforms into a central SIEM. This is essential for detecting anomalous activity. This relates to D3FEND's Cloud API Monitoring.
- Behavioral Analytics (UEBA): Use User and Entity Behavior Analytics to baseline normal activity within third-party apps and alert on deviations, such as a user accessing unusual data or logging in at odd hours.
- Data Flow Monitoring: Where possible, monitor data flows between your organization and third-party platforms to detect unusually large data transfers.
Response:
- Revoke Access: If a third-party compromise is suspected, immediately revoke the platform's access to your systems and force a password reset for all users of that platform.
- Notify Vendor: Engage the third-party vendor's security team to investigate the breach on their end.
- Assess Exposure: Work with the vendor to determine what data was accessed and exfiltrated to understand the scope and notify affected parties.
Mitigation
Immediate Actions:
- Review Third-Party Access: Conduct an immediate review of all third-party vendors, the data they can access, and their security posture.
- Data Minimization: Enforce policies to prevent the storage of sensitive data (like SSNs or financial documents) in systems not designed for it, such as help-desk platforms. Implement automated data retention and deletion policies.
- Enforce MFA: Mandate MFA for all third-party service logins.
Strategic Recommendations:
- Third-Party Risk Management (TPRM): Establish a robust TPRM program that includes comprehensive security questionnaires, contractual security requirements, and rights to audit for all vendors. This is a key implementation of D3FEND's Identifier Reputation Analysis for vendors.
- Data Loss Prevention (DLP): Implement DLP policies to prevent users from uploading sensitive data to unauthorized or inappropriate third-party applications.
- Security Due Diligence: Make cybersecurity due diligence a non-negotiable part of the procurement process for any new software or service.
Top comments (0)