[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcbv0tSAihummRK-KDKGPUgheigYri6M1dvBUaRAY6yw":3},{"article":4,"iocs":37,"watch_terms":38,"solutions":39,"lesson":129},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"d228502d-2800-44bd-8e8f-41cda1d08318","ShinyHunters Claims Ernst & Young Hack","shinyhunters-claims-ernst-young-hack-d56319","Ernst & Young previously confirmed that personal and financial information was stolen from a third-party management platform. The post ShinyHunters Claims Ernst & Young Hack appeared first on SecurityWeek.","The ShinyHunters extortion group has claimed responsibility for a recent Ernst & Young data breach in which attackers stole personal and financial information from a third-party service management platform between March 28 and April 12. Compromised data includes client names, addresses, Social Security numbers, account numbers, and credit\u002Fdebit card information used for tax filings. ShinyHunters has posted EY on its Tor-based leak site and threatened to release all stolen data unless the company makes contact by July 31.","ShinyHunters claims responsibility for Ernst & Young data breach affecting tax clients.","https:\u002F\u002Fwww.securityweek.com\u002Fshinyhunters-claims-ernst-young-hack\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002FEY-Ernst-Young.jpeg","2026-07-29T06:23:34+00:00","2026-07-29T08:00:29.578511+00:00",8,[17,20,23],{"name":18,"type":19},"ShinyHunters","threat_actor",{"name":21,"type":22},"Ernst & Young","vendor",{"name":24,"type":25},"Ernst & Young Data Breach (March-April 2026)","campaign","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":26,"icon":28,"name":29,"slug":30},null,"Breaches","breaches",[32],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21],{"controls":40,"vendors":128},[41,70,99],{"slug":42,"name":43,"problem":44,"products":45},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[46,54,62],{"vendor_slug":47,"vendor_name":48,"vendor_logo":49,"product_slug":50,"product_name":51,"url":52,"description":53},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":71,"name":72,"problem":73,"products":74},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"slug":100,"name":101,"problem":102,"products":103},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",[],{"slug":130,"title":131,"body":132,"framework_refs":133,"framework_notes":146},"shinyhunters-breaches-ey-via-third-party-platform-exposing-sensitive-financial-data","ShinyHunters Breaches EY via Third-Party Platform, Exposing Sensitive Financial Data","The Ernst & Young breach highlights the critical risk posed by third-party service management platforms that handle sensitive client data. Attackers had undetected access for over two weeks (March 28–April 12), suggesting inadequate monitoring of vendor-managed environments. The compromised data — including Social Security numbers, account numbers, and payment card information — represents some of the most sensitive personal and financial data categories, amplifying regulatory and reputational consequences. This incident underscores that an organization's security posture is only as strong as the weakest link in its vendor ecosystem.",[134,135,136,137,138,139,140,141,142,143,144,145],"CIS Control 15 – Service Provider Management","CIS Control 3 – Data Protection","NIST SP 800-53 SR-3 – Supply Chain Controls and Plans","NIST SP 800-53 IR-6 – Incident Reporting","NIST SP 800-53 AU-6 – Audit Record Review","NIST Privacy Framework PR.DS-P – Data Security for Privacy","GDPR Article 28 – Processor Obligations","GDPR Article 33 – Notification of a Personal Data Breach","GDPR Article 5(1)(c) – Data Minimization","PCI DSS Requirement 12.8 – Manage Third-Party Service Providers","ITIL – Supplier Management Practice","ISO\u002FIEC 27036 – Information Security for Supplier Relationships",{}]