Threat Intelligence Brief
Curated summary with source attribution
Source: securityweek.com
Threat Risk: High
Victim: Ernst & Young (EY) and its clients
Incident: A data breach involving the theft of sensitive tax documents via a third-party platform.
Impact: Exposure of PII, including Social Security and credit card numbers, potentially affecting numerous high-profile clients.
Attacker: ShinyHunters
Analysis: Attackers exploited a third-party service management platform to exfiltrate sensitive client tax filings between March and April. This incident underscores the critical risk inherent in third-party supply chain integrations. The theft of Social Security and account numbers creates a high risk of identity theft and financial fraud for the affected parties.
Recommendations: Audit and tighten access controls for all third-party service management platforms; Implement strict data minimization and encryption for sensitive documents stored in support tickets; Enhance vendor risk management to ensure third-party partners adhere to rigorous security standards
Source: SecurityWeek
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source