Major professional services firm faces extortion threat after ShinyHunters breach

The group has threatened to publish stolen files if discussions do not begin

Prolific cybercrime group ShinyHunters has claimed responsibility for a data breach at professional services firm EY, threatening to publish stolen information unless negotiations begin by the end of the month.

EY disclosed the cyber incident earlier this month, saying a third-party IT support platform used by staff working on client tax matters had been compromised.

The company detected suspicious activity in April and found that documents had been accessed and downloaded over a period of roughly two weeks.

The firm has not publicly confirmed that ShinyHunters was behind the attack, nor has it disclosed how many clients may have been affected. However, the group has claimed responsibility.

ShinyHunters threatens data leak

In a message posted on its dark web leak site, ShinyHunters said it had been attempting to contact EY before issuing a deadline of 31st July for the company to enter negotiations.

"Yes, it was us," the group said.

"If you do not come to us to talk within the given deadline, we fully and completely intend to release all the data and files."

ShinyHunters told BleepingComputer the breach began after it obtained EY login credentials through a supply-chain attack.

According to the group, those credentials enabled access to several internal systems, including software development and cloud environments.

The hackers did not identify the third-party supplier they allege was compromised, nor did they provide evidence supporting their claims.

Sensitive tax information at risk

In its breach notification [pdf], EY said the affected platform was used by IT teams supporting employees carrying out tax-related work for clients.

Support requests submitted through the system could include documents containing personal and financial information linked to tax filings.

The company said an attacker accessed the platform between late March and mid-April before downloading multiple documents.

Cybersecurity experts have long warned that stolen tax records can be particularly valuable to criminals, who can use them to create convincing phishing emails or impersonate tax authorities in attempts to steal additional information or money.

EY has not identified the support platform involved, detailed exactly what information was exposed, or shared the total number of people affected.

The firm has said it secured the compromised systems, removed the unauthorised access and informed federal law enforcement authorities.

It is also offering affected clients two years of identity monitoring and restoration services through Experian.

A prolific cybercrime group

ShinyHunters has become one of the most prominent data extortion groups in recent years, building a reputation for stealing large volumes of corporate data and demanding payment to prevent its publication.

The group has previously been linked to attacks targeting organisations across technology, retail, telecommunications and financial services.

Recent claimed victims include food distributor Sysco and fashion company Ralph Lauren.

It has also been associated with cyber incidents involving Oracle's PeopleSoft software, the European Commission, Cisco Systems and video game developer Rockstar Games.

Security researchers have additionally linked ShinyHunters to a wider criminal alliance blamed for large-scale attacks exploiting Salesforce environments, which affected hundreds of organisations worldwide.