Ernst & Young Data Breach: Third-Party Support System Hacked

Ernst & Young (EY) has disclosed a data breach after attackers compromised a third-party IT support system containing client documents and tax information.

Attack Vector and Vulnerability Mechanics

The breach occurred when an unauthorized third party gained access to a third-party IT service management platform used by EY's tax practice. This platform stored support requests that may have included documents containing client personal and financial information. The attack highlights the risks associated with third-party vendors and supply chain attacks, which can be used as an entry point for malicious actors to gain access to sensitive information. This type of attack is consistent with the MITRE ATT&CK technique T1190: Exploit Public-Facing Application, which involves exploiting vulnerabilities in public-facing applications to gain initial access.

Similar Past Incidents

Past incidents, such as the Qantas data breach caused by a tech support scam, demonstrate the importance of securing third-party vendors and implementing robust security measures to prevent similar breaches. The 23andMe data breach settlement also emphasizes the need for enhanced data protection requirements to prevent and respond to data breaches.

"The breach highlights the importance of implementing robust security measures to protect sensitive information, including data stored with third-party vendors," said a security expert.

Who Is Affected

EY clients who had documents and tax information stored on the compromised third-party IT support system are potentially affected by the breach. The breach may have implications for various sectors, including finance and accounting, where sensitive client information is often stored.

What the Sceptics Say

Some sceptics may argue that the breach is not a major concern, as it only involved a third-party vendor and not EY's primary systems. However, this perspective overlooks the potential risks associated with third-party vendors and the importance of ensuring that all vendors and suppliers adhere to robust security standards.

How to Defend

• Implement robust security measures for all third-party vendors and suppliers, including regular security audits and penetration testing.
• Conduct thorough risk assessments to identify potential vulnerabilities and take steps to mitigate them.
• Ensure that all vendors and suppliers adhere to robust security standards, including encryption and access controls.

Key Takeaways

1. Security Teams: Implement robust security measures for all third-party vendors and suppliers, and conduct regular security audits and penetration testing.
2. CISOs: Ensure that all vendors and suppliers adhere to robust security standards, including encryption and access controls.
3. Developers: Implement secure coding practices and ensure that all applications and systems are designed with security in mind.
4. End Users: Be aware of the potential risks associated with data breaches and take steps to protect sensitive information, including using strong passwords and enabling two-factor authentication.

Sources

• BleepingComputer: Ernst & Young discloses data breach after support system hack
• Infosecurity Magazine: 23andMe Faces New Security Mandates in $18m Data Breach Settlement
• Security Affairs: Ernst & Young (EY) Investigates Data Breach Involving Third-Party Support Tickets
• GBHackers: EY Data Breach – Hackers Access Third-Party IT Support Platform and Steal Client Tax Documents
• The Register Security: Tech support scam caused massive data breach at Australian airline Qantas