[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdUjnzefaOoTYordptmI31iWcb34tfSha0L_DaG9Dwls":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"7a45ef20-c50b-447f-bb03-29bd79b4bd6e","shinyhunters-breaches-ey-via-third-party-platform-exposing-sensitive-financial-data","d228502d-2800-44bd-8e8f-41cda1d08318","ShinyHunters Breaches EY via Third-Party Platform, Exposing Sensitive Financial Data","The Ernst & Young breach highlights the critical risk posed by third-party service management platforms that handle sensitive client data. Attackers had undetected access for over two weeks (March 28–April 12), suggesting inadequate monitoring of vendor-managed environments. The compromised data — including Social Security numbers, account numbers, and payment card information — represents some of the most sensitive personal and financial data categories, amplifying regulatory and reputational consequences. This incident underscores that an organization's security posture is only as strong as the weakest link in its vendor ecosystem.","**Immediate actions:**\n- Audit all third-party platforms that store or process sensitive client data and verify their current security posture.\n- Notify affected individuals and relevant regulators (e.g., FTC, state AGs) in accordance with breach notification timelines.\n- Revoke or rotate all credentials and API keys associated with the compromised third-party platform.\n\n**Long-term improvements:**\n- Enforce contractual security requirements (SOC 2, penetration testing, encryption standards) for all vendors handling PII or financial data.\n- Implement a formal Third-Party Risk Management (TPRM) program with continuous vendor security assessments.\n- Apply data minimization principles so third-party platforms only retain the data strictly necessary for their function.\n\n**Detection measures:**\n- Deploy continuous monitoring and anomaly detection on data flows to and from third-party service platforms.\n- Require vendors to provide real-time security event logs that feed into your organization's SIEM for centralized visibility.\n- Establish defined SLAs with vendors for breach notification, ensuring incidents are reported within hours, not weeks.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 15 – Service Provider Management","CIS Control 3 – Data Protection","NIST SP 800-53 SR-3 – Supply Chain Controls and Plans","NIST SP 800-53 IR-6 – Incident Reporting","NIST SP 800-53 AU-6 – Audit Record Review","NIST Privacy Framework PR.DS-P – Data Security for Privacy","GDPR Article 28 – Processor Obligations","GDPR Article 33 – Notification of a Personal Data Breach","GDPR Article 5(1)(c) – Data Minimization","PCI DSS Requirement 12.8 – Manage Third-Party Service Providers","ITIL – Supplier Management Practice","ISO\u002FIEC 27036 – Information Security for Supplier Relationships",{},"published","2026-07-29T08:21:28.907798+00:00","2026-07-29T08:21:28.59+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.securityweek.com\u002Fshinyhunters-claims-ernst-young-hack\u002F","shinyhunters-claims-ernst-young-hack-d56319","ShinyHunters Claims Ernst & Young Hack",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":40,"name":41,"slug":42,"description":43,"color":44},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":46,"name":47,"slug":48,"description":49,"color":50},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[53,57,61],{"slug":54,"name":55,"problem":56},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":58,"name":59,"problem":60},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":62,"name":63,"problem":64},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it."]