ShinyHunters Claims Ernst & Young Breach, Sets July 31 Extortion Deadline

Ernst & Young, one of the Big Four accounting firms, is now on the wrong side of an extortion clock. On July 27, 2026, the ShinyHunters extortion gang publicly claimed responsibility for a breach of EY, saying it walked out with documents containing client tax information: the personal and financial data firms like EY collect to prepare filings. The gang set a deadline of July 31, 2026. EY has confirmed a breach but has not confirmed that ShinyHunters is behind it.

The detail that should get every IT leader's attention is not who EY is. It's how the attackers say they got in. According to ShinyHunters, they did not breach EY directly. They stole credentials in a supply-chain attack against an unidentified third party, then used those credentials to reach EY's own systems through a third-party IT service management platform the firm uses for support tickets. Per the account reported by BleepingComputer's Lawrence Abrams, the attackers claim that access extended into EY's Jira, GitHub, and Azure environments.

The timeline

The intrusion window runs from March 28 to April 12. EY did not spot unusual activity until April 23, roughly eleven days after the attackers say they were done. Disclosure came earlier in July 2026, and ShinyHunters' public claim landed on July 27 with a four-day countdown to July 31. That sequence, quiet compromise, delayed detection, months-later disclosure, then a named gang forcing the issue publicly, is the modern extortion playbook in miniature.

What EY has and hasn't said

EY says it secured its systems, removed the unauthorized access, and notified federal law enforcement. It has offered affected clients 24 months of identity monitoring through Experian. What it has not done is confirm ShinyHunters' involvement, disclose the specific compromised support system, or put a number on how many individuals are affected or how much data left the building. No record count. No data volume. That silence is itself information: either EY does not yet know the scope, or it is not saying.

The RedEye take

This breach is a clean illustration of a truth most enterprises still underprice: your attack surface includes every vendor that holds a valid credential to your environment. EY did not have to be careless for this to happen. Per ShinyHunters' own account, the failure originated at a third party, and the support platform became the bridge. A firm the size of EY runs a mature security program. It still got reached through the seams between organizations, and the attackers' first stop inside was reportedly the developer and cloud stack, Jira, GitHub, and Azure, which is exactly where you'd go to find more credentials and more data.

We'd also flag the detection gap. Sixteen days of access, and unusual activity wasn't noticed until April 23, after the attackers say the window had already closed. Extortion crews like ShinyHunters count on that lag. By the time you're reading their post, the data is already gone; the deadline is theater to convert a completed theft into a payment. Treat the July 31 date as a negotiation lever, not a technical event, and do not let it stampede your response.

What defenders should learn

• Inventory the platforms that hold live credentials into your environment, especially ITSM and support-ticket tools. A third-party support system that can reach Jira, GitHub, and Azure is not a peripheral vendor; it is a privileged path, and it should be scoped, monitored, and rotated like one.
• Assume vendor credentials will be stolen and constrain what they can do. Bind third-party access to conditional access, short-lived tokens, and per-system scoping so a single supply-chain credential theft cannot fan out across your dev and cloud stack the way this one reportedly did.
• Close the detection gap on identity, not just endpoints. The tell here was credential use inside support and developer platforms, not malware. Alert on anomalous access to Jira/GitHub/Azure from support-integration accounts, and measure your own mean-time-to-detect against this 16-day-in, spotted-on-day-26 pattern.
• Pre-stage your extortion-deadline playbook now. Decide in advance who owns the decision when a named gang posts a countdown, so a July 31-style deadline drives disciplined disclosure and client notification, not a rushed payment.
• If you are a professional-services firm, remember your breach is your clients' breach. Have the client-notification and identity-monitoring response (EY's is 24 months via Experian) ready before you need it, because the reputational damage compounds while you improvise.