EY Employees Charged After Allegedly Accessing Australian PM’s Banking Details Two Ernst & Young (EY) employees on temporary assignment at the Commonwealth Bank of Australia (CBA) have been charged with unauthorized access to the personal banking details of Australian Prime Minister Anthony Albanese. The incident, reported by the Australian Financial Review on Tuesday, has raised serious concerns about data privacy and security within financial institutions. The employees, who were also accused of accessing the banking records of at least one EY partner, were dismissed by the firm following the allegations. EY declined to comment on the matter, while a CBA spokesperson stated it would be inappropriate to discuss individual contractor cases. The Australian Federal Police charged two Sydney men in connection with the breach, highlighting vulnerabilities in data protection protocols. The case adds to growing scrutiny of the Big Four accounting firms over their handling of sensitive information. Neither Albanese’s office nor EY has provided further public statements.

ShinyHunters Claims Breach of Ernst & Young, Threatens Data Leak The cybercriminal group ShinyHunters has alleged a breach of Ernst & Young (EY), claiming to have stolen sensitive client data and threatening to publish it on the dark web if demands are not met. On July 29, 2026, the group announced the attack via a Telegram channel, sharing sample screenshots of purportedly stolen data to pressure EY into negotiations. If no agreement is reached, ShinyHunters warned the data would be released starting July 31, 2026. According to EY’s incident response investigation, unauthorized access likely occurred between March 28 and April 12, 2026, during which attackers allegedly exfiltrated tax return files and other confidential client documents. The full extent of the breach remains undisclosed, including the number of affected clients. The incident poses significant risks, as exposed financial and personal data could lead to identity theft, fraud, and targeted phishing attacks. ShinyHunters, known for high-profile extortion campaigns, has previously targeted large organizations across industries, using public leaks and dark web postings to coerce victims. Cybersecurity experts are assessing the authenticity of the leaked samples while investigations continue. No further verified details have been confirmed beyond the attackers’ claims and EY’s preliminary findings.

EY Notifies Clients of Data Breach After Third-Party Platform Compromise Ernst & Young (EY) has begun notifying affected individuals following a data breach involving a third-party IT service management platform used by its tax practice. The incident exposed personal and financial information belonging to multiple tax clients, though EY reports no evidence of misuse to date. The breach was detected on April 23, 2026, after EY’s Information Security team identified anomalous activity on the platform. An investigation, supported by an independent cybersecurity firm, determined that unauthorized access occurred between March 28 and April 12, 2026, during which attackers downloaded client-related documents. The affected systems were secured, and federal law enforcement was notified. The compromised platform, used to manage support tickets for tax-related engagements, may have contained sensitive documents, including personal and financial details tied to tax filings. While the exact data exposed varies by individual, EY’s notification letters dated July 13, 2026 confirm that affected parties will receive specific details about their compromised information. As part of its response, EY is offering 24 months of complimentary Experian IdentityWorks credit monitoring and identity restoration services to impacted individuals, with enrollment required by October 31, 2026. The firm has not disclosed the number of affected clients, the identity of the third-party provider, or the threat actor responsible for the breach.

Ernst & Young (EY), a global accounting and consulting firm, inadvertently exposed a 4-terabyte (TB) SQL Server database backup on the public internet. The unsecured .BAK file, discovered by a Neo Security researcher, contained highly sensitive internal data, including database schemas, stored procedures, API keys, session tokens, user credentials, and service account passwords—effectively a 'master blueprint' to EY’s digital infrastructure. While EY confirmed the exposure and claimed no client, personal, or confidential data was compromised, the incident stemmed from an acquired entity under EY Italy, disconnected from its global systems. The file remained accessible for an estimated week before remediation, raising concerns about potential access by malicious actors. EY’s response was praised for professionalism, though the delayed fix highlighted operational vulnerabilities. The exposure risked unauthorized access to critical systems, credential theft, and potential lateral movement within EY’s network, though the firm asserted no evidence of exploitation.

A Dutch cybersecurity firm, Neo Security, discovered a 4TB+ unencrypted SQL Server backup file belonging to EY exposed publicly on the internet due to a misconfigured cloud bucket. The leaked data included API keys, cached authentication tokens, session tokens, service account passwords, and user credentials—essentially a full blueprint for accessing EY’s internal systems. The exposure was caused by a trivial error, likely a misconfigured bucket setting, which made the sensitive backup accessible to anyone. While the exact duration of exposure is unclear, such incidents typically assume compromise from the moment of discovery.The breach mirrors a past case Neo Security investigated, where a lazy database migration (temporarily setting a bucket to public) led to a ransomware attack and the eventual collapse of the affected company after data theft. EY responded professionally upon notification, remediating the issue within a week. However, the exposed credentials and trade secrets pose severe risks, including potential follow-on attacks, financial fraud, or espionage by threat actors who may have already downloaded the data.

India-based IT consulting giant, Infosys, has faced legal challenges due to a data breach in its U.S. subsidiary, McCamish Systems, during November 2023. This breach, which compromised the personal information of approximately 6.5 million individuals, affected customers of Bank of America and Fidelity Investment Life Insurance. A consolidated class action lawsuit was filed, claiming representation of all U.S. residents whose data was exposed. Infosys has agreed to a settle the matter with a $17.5 million payment, which aims to cover remediation efforts and legal claims, appeasing the affected customers and potentially mitigating further financial and reputational damage.

On August 9, 2023, the Washington State Office of the Attorney General reported a data breach affecting Ernst & Young LLP (EY US). The breach occurred from May 27, 2023, to May 31, 2023, involving a third-party service vulnerability in Progress Software’s MOVEit Transfer solution. The breach affected 1,129 Washington residents, compromising personal data including names, Social Security numbers, and financial information.

A 4TB SQL Server backup file belonging to Ernst & Young (EY) was discovered publicly exposed on Microsoft Azure by cybersecurity firm Neo Security. The unencrypted .BAK file, identified during routine passive network analysis, likely contained sensitive data such as database schemas, user credentials, API keys, and authentication tokens. Ownership was confirmed via DNS SOA lookup linking to ey.com, though initial searches showed no explicit owner. While EY remediated the exposure swiftly and claimed no client or confidential data was compromised, the incident underscored the high risk of automated scanning tools discovering such leaks. The exposure duration and potential access by malicious actors remained unclear, but past incidents demonstrated that even brief cloud exposures could lead to PII and credential theft. The case highlighted critical gaps in cloud visibility and leak detection, emphasizing the need for continuous attack surface monitoring in complex cloud environments.