Skip to content
Breach Index · posture trend

EY (Ernst & Young): what the record actually shows

EY is one of the Big Four — a firm that advises the world's largest organisations on cyber risk. Its own documented incidents between 2023 and 2026 are not a story of a weak network; they are a story of the risks every modern enterprise shares: a vulnerable file-transfer vendor, a cloud bucket left open, a third-party platform breached, an acquisition's data. The same problems EY helps clients solve.

EY's publicly documented cyber record is concentrated in third-party and cloud-exposure events, not a direct compromise of its core network. Confirmed items include the 2023 MOVEit/Cl0p supply-chain wave (a notice for 30,210 Bank of America customers), a ~4TB SQL Server backup found exposed on Azure in October 2025 (EY: no client or confidential data compromised; from an acquired EY Italy entity), and a 2026 intrusion into a third-party tax-support platform. A 2026 ShinyHunters leak-site claim remains unverified. Each item below is tagged and dated.

The uncomfortable question

If a firm whose entire brand rests on trust — whose consultants walk into boardrooms and tell CISOs how to manage vendor risk, lock down cloud storage and prepare for ransomware — still ends up in breach notices, what does that tell you about your own programme?

The honest answer is uncomfortable: resources and expertise do not make the structural problems go away. A single third-party tool with a zero-day, one misconfigured storage account, one acquired company with its own history — any of these can put a world-class firm in the headlines. The goal of this page is not to embarrass EY. It is to use a well-resourced firm's documented record as a mirror for the risks that sit in every organisation, and to point at what a security leader can actually do about them.

Incident timeline

Every entry is tagged: Confirmed (company-acknowledged or regulator-filed), Reported (credible press, firm not denying), Unverified claim (threat-actor or leak-site claim, not confirmed).

May–Nov 2023

MOVEit / Cl0p supply-chain wave

Confirmed

What happened. EY used Progress Software’s MOVEit Transfer, the managed file-transfer tool whose zero-day (CVE-2023-34362) the Cl0p ransomware group mass-exploited across 2,000+ organisations. EY said its supplier notified it of the vulnerability on May 31, 2023, that it promptly launched an investigation and secured its systems, and that the vast majority of its systems using the service were not compromised.

Impact. EY filed a data-breach notice with the Maine Attorney General on Aug 9, 2023 reporting that 30,210 Bank of America customers may have had personal data acquired — names, addresses, financial-account and card numbers, Social Security and other government ID numbers. A separate Washington AG notice listed 1,129 state residents. Cl0p listed EY on its leak site and claimed to hold ~3 terabytes of EY data; that volume claim was never independently verified. EY did not pay.

Source: EY breach notice to the Maine AG (Aug 2023); Going Concern, Aug 10, 2023; SecurityWeek, 2023

Oct 2025

4TB SQL Server backup left open on Azure

Confirmed

What happened. Dutch firm Neo Security reported finding an unencrypted ~4TB SQL Server backup (a .BAK file) belonging to EY reachable from the open internet on Microsoft Azure, due to a storage misconfiguration. The researcher verified ownership via merger documents and a DNS SOA lookup and confirmed it was unencrypted by downloading a small sample. Reporting said the file contained material such as API keys, cached auth/session tokens, service-account passwords and user credentials.

Impact. EY confirmed the exposure but stated that no client, personal or confidential data was compromised, that the file originated from an acquired entity under EY Italy disconnected from its global systems, and that it was remediated. The duration of exposure is disputed in reporting (from hours to about a week), and no malicious access to the data has been confirmed. This was a direct EY cloud misconfiguration, not a third-party breach.

Source: The Register, Oct 29, 2025; Neo Security research blog, 2025; TechRadar Pro, Oct 2025

Mar–Jul 2026

Third-party tax-support platform intrusion

Confirmed

What happened. EY notified several U.S. state Attorneys General that a third-party IT service-management platform — used by EY staff to support tax work for clients — was accessed without authorisation between March 28 and April 12, 2026. EY said it identified anomalous activity on April 23, 2026, that an independent cybersecurity firm confirmed the access had stopped, and that documents attached to customer support tickets were downloaded.

Impact. Reported data types include names, addresses, Social Security numbers, bank-account and payment-card details and other tax records. EY said the affected data lived on the external platform, not its core internal systems, and offered 24 months of credit, identity monitoring and identity restoration. EY has not disclosed how many individuals were affected.

Source: EY notification letters to U.S. state AGs (July 2026); Security Affairs, Jul 29, 2026; AccountingTimes, 2026

Jul 2026

ShinyHunters leak-site listing and claim

Unverified claim

What happened. The extortion group ShinyHunters added EY to its Tor leak site in connection with the 2026 tax-platform incident, claiming it obtained access through credentials from an alleged supply-chain compromise, and set a July 31, 2026 deadline for EY to begin negotiations.

Impact. This is the group’s claim. EY has not publicly attributed the intrusion to ShinyHunters, nor confirmed the group’s account of how access was obtained or what was taken. Treat the attribution and any data-volume figures from the group as unverified extortion-site claims, not established fact.

Source: Security Affairs, Jul 29, 2026 (reporting the group’s leak-site claim)

The pattern: third-party and cloud exposure, not core compromise

Read the timeline as a whole and a clear signature emerges. EY's documented exposure is almost entirely at the edges of its estate — the software and platforms it depends on, and the data that sits in cloud storage — rather than deep inside a hardened core network. Three of the four entries are third-party or supply-chain in nature.

3 of 4

documented items originate with a third-party tool, platform or acquired entity — not EY's own production systems.

30,210

individuals in EY's single confirmed regulatory breach notice — the 2023 MOVEit / Bank of America filing.

~4TB

SQL Server backup reported exposed on Azure in 2025 — a cloud-storage misconfiguration, tied to an acquired entity.

That signature is not unique to EY — it is the modern enterprise risk map. File-transfer appliances like MOVEit became a mass-casualty event precisely because so many organisations trusted one vendor with sensitive data in motion. Cloud backups end up internet-reachable because object-storage defaults and hurried migrations make "exposed" the easy state and "locked down" the deliberate one. And acquisitions drag unknown systems and old data into the parent's attack surface faster than security teams can inventory them.

It is worth stating plainly what the record does not show: there is no public evidence of a broad compromise of EY's internal audit or client-engagement platforms, and EY has disputed the sensitivity of the 2025 cloud exposure. Regulatory fines EY has faced in audit and accounting matters are a separate governance story and are deliberately excluded here — they are not cyber breaches.

CISO takeaways — and tools to act on them

1. Make third-party risk a live register, not a spreadsheet

Every file-transfer tool, SaaS platform and support vendor is a potential MOVEit. Track them, rate them, and tie each to the data it touches and the blast radius if it falls.

Vendor Risk toolRisk Register

2. Map your supply chain before an attacker does

Software dependencies are where mass-casualty events start. Know what you ship and depend on, and watch for the next compromised package or appliance.

Supply-Chain Tracker

3. Rehearse the ransomware / extortion decision now

EY did not pay Cl0p. The groups behind these events — Cl0p, ShinyHunters — run leak-site extortion. Decide your posture, legal line and comms before you are on a countdown clock.

Ransomware tool

4. Put a number on it, and read the wider pattern

Translate exposure into a dollar range the board understands, and study how breaches cluster across even the best-resourced firms.

Breach Cost IndexFull Breach Index

Sources

  1. SecurityWeek — "Over 130 Organizations, Millions of Individuals Believed to Be Impacted by MOVEit Hack," 2023 (EY among the named filers; Bank of America / 30,210-individual figure reported via US state breach notices). https://www.securityweek.com/over-130-organizations-millions-of-individuals-believed-to-be-impacted-by-moveit-hack/
  2. Going Concern — "EY, Bank of America security breach," Aug 10, 2023. https://www.goingconcern.com/ey-bank-of-america-security-breach
  3. Going Concern — "EY and PwC Among the Many Entities Caught Up in the MOVEit Cybersecurity Breach Ransom," 2023. https://www.goingconcern.com/ey-and-pwc-among-the-many-entities-caught-up-in-the-moveit-cybersecurity-breach-ransom/
  4. Wikipedia — "2023 MOVEit data breach" (background on CVE-2023-34362 and the Cl0p campaign). https://en.wikipedia.org/wiki/2023_MOVEit_data_breach
  5. SecurityWeek — "Over 130 Organizations, Millions of Individuals Believed to Be Impacted by MOVEit Hack," 2023. https://www.securityweek.com/over-130-organizations-millions-of-individuals-believed-to-be-impacted-by-moveit-hack/
  6. The Register — "EY exposes 4TB+ SQL database to open internet for who knows how long," Oct 29, 2025. https://www.theregister.com/2025/10/29/ey_exposes_4tb_sql_database/
  7. TechRadar Pro — "EY reportedly leaked a massive 4TB database online," Oct 2025. https://www.techradar.com/pro/security/ey-reportedly-leaked-a-massive-4tb-database-online-exposing-company-secrets-online-for-all-to-see
  8. Neo Security — research blog, "EY data leak: 4TB SQL Server backup," 2025. https://www.neosecurity.nl/en/blog/ey-data-leak-4tb-sql-server-backup
  9. Security Affairs — "ShinyHunters Claims Ernst & Young Data Breach, Threatens to Leak Stolen Data," Jul 29, 2026. https://securityaffairs.com/196239/data-breach/shinyhunters-claims-ernst-young-data-breach-threatens-to-leak-stolen-data.html
  10. AccountingTimes — "Ernst & Young tells clients of third-party data breach," 2026. https://www.accountingtimes.com.au/profession/ernst-young-tells-clients-of-third-party-data-breach

Where a figure or attribution comes only from a threat actor's leak site, it is labelled an unverified claim above and stated as a claim. Primary regulatory filings and EY's own statements are preferred over secondary coverage wherever available. As of October 15, 2026.

Frequently asked questions

Has EY (Ernst & Young) been breached?

EY’s publicly documented cyber record is dominated by third-party and cloud-exposure events rather than a direct compromise of its core network. In 2023 EY was caught in the MOVEit/Cl0p supply-chain wave and filed a breach notice for 30,210 Bank of America customers. In October 2025, researchers reported a ~4TB EY SQL Server backup left open on Azure, which EY confirmed as an exposure while saying no client or confidential data was compromised. In 2026 EY notified U.S. state Attorneys General of unauthorised access to a third-party tax-support platform. A separate claim by the ShinyHunters group is unverified.

Was the 2023 MOVEit incident EY’s fault?

The root cause was a zero-day vulnerability (CVE-2023-34362) in Progress Software’s MOVEit Transfer product, which the Cl0p group mass-exploited across more than 2,000 organisations worldwide. EY was one victim among many that used the tool. It is best understood as third-party supply-chain risk: EY did not write the vulnerable software, but it was responsible for the client data that flowed through it.

Did Cl0p really steal 3 terabytes of EY data?

Cl0p claimed on its leak site to hold about 3TB of EY data. That figure was never independently verified and should be treated as an extortion-group claim, not an established fact. What is documented through EY’s own regulatory filing is the 30,210-individual Bank of America notification.

Is the 2026 ShinyHunters claim confirmed?

No. EY confirmed, via notifications to state Attorneys General, that a third-party tax-support platform was accessed without authorisation between March 28 and April 12, 2026. The attribution of that intrusion to ShinyHunters, and the group’s account of how it obtained access, are the group’s own claims and have not been confirmed by EY. This page states them as claims.

What is the lesson for security leaders?

A firm that sells cyber advisory services faces the same structural risks as its clients: third-party and supply-chain exposure, cloud misconfiguration, and inherited risk from acquisitions. EY’s record across 2023–2026 clusters precisely on those themes. The practical takeaways are to inventory and continuously assess every vendor and file-transfer dependency, treat cloud storage as exposed by default until proven otherwise, and scope acquired entities into your security programme on day one.

This page is independent security analysis for educational purposes. It is not affiliated with or endorsed by EY / Ernst & Young. All incidents are drawn from public reporting and regulatory filings cited above; claims that are not confirmed are labelled as such.

🎉 New here? Use code WELCOME10 for 10% off any plan at checkout
EY (Ernst & Young) Breach Index — Posture & Incident Trend | PlayCISO · PlayCISO