A breach that predates its own disclosure
EY, one of the four largest professional services firms in the world, confirmed that unauthorized access occurred on systems connected to a client tax support platform. According to the company's own account, the intrusion window ran from March 28 to April 12, and internal teams detected the unusual activity on April 23. That timeline puts more than three months between detection and the point at which the broader public learned about it, a gap that only closed once an extortion group put a deadline on the table. For a firm whose client base includes some of the largest corporations in the world, three months of silence is a long time for exposure to sit unacknowledged, even if internal remediation was already underway.
EY says it secured the affected systems after detection, notified federal law enforcement, and began offering affected individuals two years of identity monitoring through Experian. What the company has not done is confirm the specific claims an extortion group is now making about how deep the access went or how much data left the environment, leaving clients to weigh two different accounts of the same incident. That gap between the company's controlled narrative and the attacker's public claims is where corporate clients now have to make their own risk judgment, without a definitive account from either side to settle it.
Stolen credentials, not a software exploit
ShinyHunters, the extortion group claiming responsibility, says the path in ran through a supply chain compromise rather than a flaw in EY's own applications. The group claims it obtained valid EY credentials from a third party and then used those credentials to move into the company's Jira, GitHub, and Azure environments, three platforms that between them hold project tracking data, source code, and cloud infrastructure configuration. That combination gives an attacker with valid credentials a wide view into how EY builds and operates its internal software, well beyond whatever the tax support platform itself exposed.
EY has not named the compromised third party, which leaves an important part of the story unverified. Credential based intrusions through a vendor are harder to detect than a direct exploit because the activity looks like legitimate access from a trusted source until the volume or destination of the requests gives it away. That is precisely the pattern security teams have flagged with ShinyHunters campaigns elsewhere this year, where a single upstream credential leak becomes the entry point for several downstream victims.
What ShinyHunters says it is holding
The group claims its haul goes beyond what EY has publicly acknowledged, and specifically points to personal and financial information drawn from tax related support tickets. Support ticket systems tend to accumulate exactly the kind of sensitive attachments that formal data classification policies are built to prevent: scanned documents, screenshots of financial statements, and correspondence that clients assumed was private and disposable once the ticket closed. None of that material was ever meant to sit in a searchable archive years after the ticket that generated it was resolved.
ShinyHunters set a deadline of July 31 for EY to respond, framing the ultimatum in the same public extortion playbook the group has used against other large targets this year: publish proof of access, name a few files, and set a clock running to pressure a response before all of the data is dumped. EY has not confirmed whether it engaged with the group or what, if anything, was negotiated before the deadline passed.
The response and its limits
EY's public statement acknowledges that support tickets submitted through the affected platform may include documents containing client tax information, which is as close as the company has come to validating the sensitivity of what was exposed. Offering credit monitoring is a standard response to this class of incident, but it addresses identity theft risk for individuals rather than the confidentiality risk that concerns the firm's corporate clients, whose tax strategy and financial position are exactly the kind of information a professional services relationship is supposed to protect. Corporate clients cannot enroll in Experian monitoring on behalf of their tax strategy.
For a firm whose entire business model rests on client trust in the confidentiality of sensitive financial data, an unresolved dispute over the scope of a breach carries reputational weight beyond the direct cost of remediation. Clients evaluating their own exposure will want a harder answer than EY has given so far about exactly which support tickets, and therefore which clients, fall inside the compromised window. Until that accounting arrives, every client who ever filed a support ticket through the affected platform has to assume their own documents are part of the exposure.
Why professional services firms keep showing up in extortion campaigns
Accounting, tax, and advisory firms sit at a uniquely attractive intersection for extortion actors: they aggregate sensitive financial data from hundreds of client organizations in one place, they operate under confidentiality obligations that make a leak reputationally expensive to ignore, and their internal tooling, in this case Jira, GitHub, and Azure, mirrors the same developer and cloud infrastructure that any large enterprise runs. A single compromised credential does not just expose the firm, it exposes every client whose data passed through that platform, multiplying the leverage an extortion actor holds far beyond what the firm's own headcount would suggest.
Big Four and comparable professional services firms have appeared in extortion groups' crosshairs repeatedly this year, and the pattern shows no sign of slowing. As long as these firms centralize client financial data behind conventional enterprise tooling, credential theft through a supply chain vendor will remain one of the more efficient paths an extortion group can take to a high value payout, and each new incident makes the next one easier to script.
The identity and third-party risk lesson
The most actionable detail in this incident is the vector: stolen credentials from a supply chain relationship, not a novel exploit against EY's own code. That means the defense that would have mattered most is not a patch but identity hygiene, specifically credential rotation policies, conditional access rules that flag logins from unfamiliar locations, and vendor access reviews that catch a third party credential still active long after it should have been revoked.
For enterprise technology leaders, the practical takeaway is to audit which third parties hold standing credentials into your own Jira, GitHub, and cloud environments today, and whether those credentials are scoped narrowly enough that a single compromised vendor account cannot reach the breadth EY's attackers apparently achieved. Support ticket systems in particular deserve a second look, since they tend to accumulate sensitive attachments outside the formal data classification controls applied to production systems.
