EY.COM Listed by clop Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure large professional-services firms by stealing internal material and threatening public release, a pattern that has become a routine feature of the current threat landscape. In that context, the appearance of EY.COM on a clop leak site in mid-2023 drew attention because of the firm’s global reach and the sensitive nature of the work such organisations perform.

Public reporting on 23 June 2023 stated that EY.COM had been listed by the clop ransomware group, which claimed that internal files had been exfiltrated in a ransomware attack. The number of people affected remains unknown, and independent confirmation of the group’s claims has not been supplied in the available record. The incident matters because any compromise involving a major advisory firm can expose confidential business information and, potentially, data linked to clients and staff.

Breaking down the breach

According to the reported facts, EY.COM was listed by the clop ransomware group on or around 23 June 2023. The group’s claim centres on the exfiltration of internal files during a ransomware attack. No public figure has been given for the volume of data taken, the precise date the intrusion began or ended, or the technical method used to gain access. The number of individuals whose information may have been involved is listed as unknown. Beyond the leak-site listing itself and the description of internal files, further operational detail has not been disclosed in the material available for this account. The listing should be treated as an unverified claim by the threat actor unless and until the organisation or independent investigators state it.

Who is clop?

Clop is a well-documented ransomware operation that has been active for several years. The group is known for double-extortion tactics: encrypting systems where possible while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. Clop has repeatedly targeted large enterprises and has been associated with exploitation of vulnerabilities in widely used file-transfer and enterprise software, though the specific vector in any individual case is not always confirmed publicly. The group typically posts victim names and sample files or descriptions on its leak site to increase pressure. In this instance, the only claim tied directly to EY.COM is the listing itself and the assertion that internal files were exfiltrated; no further statements by the group about this particular victim are part of the provided record.

EY.COM and its sector

EY.COM is the online presence of Ernst & Young, one of the global “Big Four” professional-services networks. Firms of this type provide audit, tax, consulting, and advisory services to corporations, governments, and other institutions worldwide. Their work routinely involves access to financial statements, strategic plans, personal data of employees and clients, and commercially sensitive material. Because these organisations sit at the centre of trust and compliance relationships, a breach affecting them can have consequences that extend well beyond a single corporate network. The sector as a whole has been a recurring target for ransomware groups precisely because of the volume and sensitivity of the information held and the reputational stakes involved.

The information in question

The available facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory—such as specific document categories, databases, or personal-data fields—has been disclosed. Organisations of EY’s type typically maintain client working papers, internal correspondence, human-resources records, and proprietary methodologies. Whether any of those categories were among the files claimed by clop is unconfirmed. Readers should therefore treat the precise contents of the alleged exfiltration as unknown pending further official or investigative detail.

What's at stake

For individuals, the principal risks centre on the possible exposure of personal or professional information that could be misused for fraud, social engineering, or identity-related harm. Because the scale and exact data types remain undisclosed, it is not possible to quantify how many people, if any, face direct exposure. For the organisation, the stakes include potential regulatory scrutiny, contractual obligations to notify clients, and the broader erosion of confidence that follows any credible claim of data theft. Even when a listing is later disputed or limited in scope, the period of uncertainty itself can disrupt operations and require costly forensic and legal responses. In concrete terms, affected parties may need to monitor for unusual account activity, review contractual notification duties, and assess whether privileged or regulated information was involved—steps that cannot be completed until more is known.

Were you affected?

If you have a past or present relationship with EY—as an employee, contractor, or client—consider practical first steps: monitor financial and email accounts for unexpected activity, enable multi-factor authentication where available, and be alert to phishing attempts that reference the firm or the incident. Official notifications, if any are required, would normally come directly from the organisation. Because the number of people affected and the exact data involved remain unknown, individuals cannot yet determine personal impact from public sources alone. You can run a free exposure scan of your email address to check whether your information has already surfaced in known breach datasets, which may provide an additional point of reference while waiting for further clarity.

AICompiled with AI assistance from public sources and published under our editorial standards.