ShinyHunters claims an Ernst & Young breach that started with someone else's stolen credentials

The ShinyHunters extortion gang claimed responsibility for a breach at Ernst & Young, saying it obtained EY credentials through a supply-chain attack while declining to name the compromised third party. Using those credentials, the group says it reached EY's Jira, GitHub, and Azure environments. EY had already disclosed that support tickets may have contained client tax information, including personal and financial data used in filings; ShinyHunters claims access to that data plus more, and set a July 31, 2026 deadline before threatening to release it. According to the reporting, unauthorized access ran from March 28 to April 12, 2026, was detected April 23, and disclosed by EY earlier in July. EY has not confirmed ShinyHunters' involvement, and the claims have not been independently verified.

Why it matters

A supply-chain credential compromise means the weak point wasn't EY's own defenses, it was a vendor whose credentials happened to unlock EY's Jira, GitHub, and Azure. That's the same shape as the Snowflake customer credential attacks: the breached organization's security posture is only as strong as every third party holding valid credentials to its systems.

Treat vendor and contractor credentials as first-class identities in your access reviews, not an afterthought, and confirm those accounts carry MFA and scoped, time-limited access rather than standing admin rights into source control and cloud infrastructure.

Source: BleepingComputer