ShinyHunters claims an Ernst & Young breach that started with someone else's stolen credentials
The extortion group says it used credentials obtained through a supply-chain attack, source undisclosed, to reach EY's Jira, GitHub, and Azure environments, and set a deadline before threatening to release data including client tax information.
The ShinyHunters extortion gang claimed responsibility for a breach at Ernst & Young, saying it obtained EY credentials through a supply-chain attack while declining to name the compromised third party. Using those credentials, the group says it reached EY's Jira, GitHub, and Azure environments. EY had already disclosed that support tickets may have contained client tax information, including personal and financial data used in filings; ShinyHunters claims access to that data plus more, and set a July 31, 2026 deadline before threatening to release it. According to the reporting, unauthorized access ran from March 28 to April 12, 2026, was detected April 23, and disclosed by EY earlier in July. EY has not confirmed ShinyHunters' involvement, and the claims have not been independently verified.
Why it matters
A supply-chain credential compromise means the weak point wasn't EY's own defenses, it was a vendor whose credentials happened to unlock EY's Jira, GitHub, and Azure. That's the same shape as the Snowflake customer credential attacks: the breached organization's security posture is only as strong as every third party holding valid credentials to its systems.
Treat vendor and contractor credentials as first-class identities in your access reviews, not an afterthought, and confirm those accounts carry MFA and scoped, time-limited access rather than standing admin rights into source control and cloud infrastructure.
Source: BleepingComputer
Related on Start with Identity
- BlogChick-fil-A's second credential stuffing breach in three years hit 13,322 loyalty accounts
Automated login attempts using credentials obtained from a third-party source, not a Chick-fil-A breach, compromised 13,322 Chick-fil-A One loyalty accounts ove
- BlogAbbott investigates two incidents, one starting with a vished Entra account
Abbott confirmed unauthorized access to legacy Exact Sciences systems after a mid-June vishing attack compromised a Microsoft Entra single sign-on account. Shin
- BlogOAuth client ID spoofing lets attackers validate stolen Entra credentials
Proofpoint found two campaigns submitting forged OAuth client IDs to Entra's token endpoint. Because error responses differ by whether the client ID is valid, a
- GuideAuthentication vs Authorization: The Difference That Trips Everyone Up
Authentication and authorization sound alike and are often shortened to the same "authZ/authN," but they answer different questions. Getting them straight is fo
- ArticleB2B SaaS Security Tools: The Stack That Gets You Through Enterprise Procurement
The security tooling a B2B SaaS product actually needs to close enterprise deals in 2026, from enterprise SSO and SCIM to audit logs, secrets scanning, and acce
- GlossaryClaims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so