Ernst & Young Notifies Clients of Data Theft Following Breach of Third-Party IT Ticketing System
NEOSEC enrichment — no mirror of the original source
Auditing and professional services provider Ernst & Young (EY) has begun notifying clients about a cybersecurity incident that resulted in the compromise of the clients' personal and financial information. The breach occurred on the system
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Editorial context in the original issue
The SANS NewsBites issue carries commentary by: Neely.
More on Third-Party
Other advisories
- Not ratedosv:CLEANSTART-2024-WL03752WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension
- MediumCVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- CriticalCVE-2026-116692MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
- CriticalCVE-2026-116692MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
- Not ratedosv:CVE-2026-116692MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules
- MediumCVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- MediumCVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- Not ratedosv:CVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
Other news entries
- Japan Airlines suffers third-party data breach exposing passenger infoNewsBleepingComputer
- Polymarket halts trading after crypto-draining script breach, $2.5M tracedNewsBleepingComputer
- HHS Filing Puts iRhythm Data Breach Toll at 8.2 MillionNewsSecurityWeek
- Polymarket halts trading after a compromised third-party provider drains user wallets through its websiteBreachpwn.watch
- Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.NewsThe Hacker News
- Attackers compromised 42 GitHub repositories by using files too large to be searchedNewsCSO Online
- bunny.net pulls an Armenia CDN node after its hosting provider is breached and reissues TLS certificatesBreachpwn.watch
- Warp discloses breach exposing AI agent logs, user telemetry dataNewsBleepingComputer
ID