Ernst & Young (EY), a global accounting and consulting firm, inadvertently exposed a 4-terabyte (TB) SQL Server database backup on the public internet. The unsecured .BAK file, discovered by a Neo Security researcher, contained highly sensitive internal data, including database schemas, stored procedures, API keys, session tokens, user credentials, and service account passwords—effectively a 'master blueprint' to EY’s digital infrastructure. While EY confirmed the exposure and claimed no client, personal, or confidential data was compromised, the incident stemmed from an acquired entity under EY Italy, disconnected from its global systems. The file remained accessible for an estimated week before remediation, raising concerns about potential access by malicious actors. EY’s response was praised for professionalism, though the delayed fix highlighted operational vulnerabilities. The exposure risked unauthorized access to critical systems, credential theft, and potential lateral movement within EY’s network, though the firm asserted no evidence of exploitation.

Infosys McCamish Systems experienced a data breach resulting from a LockBit ransomware attack, impacting over 6 million individuals. The breach saw unauthorized access to a substantial amount of sensitive personal data, including names, Social Security numbers, medical information, financial account information, and passport numbers. The incident led to the non-availability of certain applications and systems, and subsequent restoration and security measures resulted in at least $30 million in losses for the company. Additional costs are anticipated due to potential indemnities or damage claims.

On November 2, 2023, Infosys McCamish Systems, LLC fell victim to a ransomware attack that encrypted critical systems, compromising personal information of individuals. The exposed data included names, though the exact number of affected individuals remains undisclosed. The incident was formally reported to the California Office of the Attorney General on July 19, 2024, nearly eight months after the breach occurred. The delay in disclosure raises concerns about the company’s incident response timeline and potential risks to affected parties, such as identity theft or phishing attempts targeting the leaked personal details. While the full scope of the attack—including whether additional sensitive data (e.g., financial records, Social Security numbers) was accessed—has not been confirmed, the encryption of systems suggests operational disruptions. Ransomware attacks of this nature often involve threats of data exfiltration or permanent encryption unless a ransom is paid, though the report does not specify whether such demands were made or met.

The Maine Office of the Attorney General reported that Infosys McCamish Systems, LLC (IMS) experienced a data breach involving ransomware, affecting the personal information of 11,866 Maine residents. The breach was discovered on November 2, 2023, and the company began notifying individuals on June 27, 2024. Approximately 6,078,263 individuals were affected in total and identity theft protection services were offered for 24 months via Kroll.

In late 2023, Infosys McCamish Systems LLC suffered a ransomware attack that led to a massive data breach, compromising the personal, biometric, financial, and protected health information of approximately 3.7 million individuals in the U.S. The breach exposed sensitive data, resulting in a $17.5 million class-action settlement to address claims of identity theft risks, financial fraud, and inadequate security measures. Victims were offered up to $6,000 in reimbursements for documented losses (e.g., fraud, legal fees, credit monitoring) and two years of credit monitoring with $1 million identity theft insurance. The lawsuit alleged failure to protect data and delayed breach notifications, though the company denied liability. The attack’s scale and the highly sensitive nature of leaked data—including health and financial records—posed severe risks to affected individuals, leading to legal and reputational consequences for the company.