Ponderwall reported on 18 October that an unauthorized actor got into an internal IT ticketing platform run by Ernst and Young. It places the access between late March and mid-April. The intruder searched thousands of support tickets and downloaded the files attached to them. Ponderwall says the exposed records belonged to the wealth management arm of Goldman Sachs, the hedge fund Man Group and the property firm Tishman Speyer. It lists tax filings, passport scans and personal identification numbers among the files.
Ponderwall says the networks of Goldman Sachs and Man Group were not breached. It says threat intelligence researchers blame a group called ShinyHunters, and links the attack to a flaw tied to Checkmarx software. It says the intruders were active for eleven days. Ponderwall does not say how many people or files were affected. It does not say how the intruder first got in, or whether the data has been published or used for a ransom demand. It also gives no statement from Ernst and Young or the named clients.
For teams that run or buy software, the case shows where client files can pile up. Ponderwall says staff attached source documents to IT tickets, so sensitive records sat in a tool outside the main systems. Any ticketing or help desk tool that takes attachments may hold similar files.