Ernst & Young

Ernst & Young disclosed a data breach involving a third-party management platform. The ShinyHunters extortion gang claimed responsibility, stating it obtained credentials for some of the firm's systems through a supply-chain attack.

EY is offering affected individuals two years of free credit monitoring, identity monitoring, and identity restoration services. The number of affected individuals has not been publicly disclosed as of this writing. ShinyHunters has been the most active extortion operation of 2026, with a documented pattern of SaaS-tenant compromise; Microsoft published guidance in July on defending against the group's OAuth abuse techniques.

Per EY's disclosure, the stolen data includes names, addresses, Social Security numbers, credit and debit card numbers, and other personal and financial information.

Social Security numbers and payment card numbers in the same record set is an unusually damaging combination, and it is worth being precise about why. An SSN enables identity-level fraud that persists for years and cannot be reissued in practice. A card number enables immediate financial fraud but is trivially cancelled. Exposed together, the victim faces both the fast attack and the slow one, and remediating the first does nothing about the second.

The individuals in these records are largely not EY employees. Professional services firms hold data belonging to clients and, in many engagements, to their clients' customers and workforces — payroll populations in a tax engagement, plan participants in a benefits audit, claimants in a forensic matter.

None of those people selected the platform. Most did not know their information had been transferred to a Big Four firm at all, let alone onward into a vendor tool supporting the engagement. They have no relationship to leverage, no account to secure, and no way to have assessed the risk in advance. They will learn the platform existed from a notification letter. With SSNs exposed, the realistic harms are fraudulent tax filings and new-account fraud; with card numbers, direct fraud until reissue.

EY is a firm whose business includes assessing whether other organizations' internal controls are adequate. Its own control environment, third-party risk program, and vendor due diligence are unquestionably formal, documented, and audited — professional services firms are contractually obligated to demonstrate exactly that to win engagements.

Third-party risk management is the control that was in place, and this is precisely the failure mode it does not address. Vendor due diligence evaluates a supplier's security posture at a point in time. It produces a questionnaire response, a SOC 2 report, and a contractual commitment. What it does not produce is an ongoing record of which datasets your engagement teams have actually loaded into that vendor's platform since the assessment closed.

Professional services has a structural data problem that most industries do not. Data arrives continuously, from hundreds or thousands of separate engagements, each with its own scope, its own client, its own retention terms, and its own tooling chosen by the partner running it. The firm does not generate this data. It receives it, processes it, and is then obligated to hold or dispose of it under engagement-specific terms.

Multiply that across a global partnership and the question "which platform holds regulated personal data from which engagement?" has no single owner and no central answer. A third-party management platform is exactly the kind of system that accumulates this exhaust — procured centrally, used broadly, populated by whoever needed it, and never re-inventoried.

The firm that certifies whether your controls are adequate is running the same vendor sprawl you are, for the same reason: nobody's job description includes counting it.

Attribution here is unusually tangled because EY is, for most of this data, not the originating controller. Determining who to notify requires first determining which client engagement each record came from, then reading the engagement terms to establish whether EY notifies directly or the client does, then applying the breach statute of each affected individual's jurisdiction.

Because SSNs and card numbers are involved, effectively every US state statute is triggered, including California's 30-day notification requirement under SB 446 effective January 1, 2026 — filings surface on the California AG breach list. Any EU personal data engages GDPR's 72-hour supervisory authority deadline. Running alongside all of it is a client-notification exercise with no legal deadline and severe commercial consequences: every affected client must be told that its data was in the platform, which requires knowing, per client, exactly what was there.