Deloitte Ransomware Claim: What the EY Comparison Misses

Deloitte has appeared in reporting about a ransomware group's latest extortion claim. That is worth investigating. It is not yet a confirmed Deloitte breach.

Orbitaley reported on 9 October that The Gentlemen had listed the professional services firm on its leak site and claimed to hold corporate information. The report explicitly says it has not independently verified the data, the affected systems or the entities involved.

The comparison circulating on LinkedIn is straightforward: first EY, now Deloitte. But those two stories do not stand on the same evidence. EY disclosed an incident involving client documents. The Deloitte story, on the public evidence reviewed for this article, remains a reported criminal claim.

Where the Deloitte claim starts

The source behind the LinkedIn post is Orbitaley. A public ransomware tracker also records a Deloitte entry dated 9 October. That supports the existence of a circulating listing claim, not proof that the attackers accessed Deloitte's systems. Trackers may draw on the same underlying feed; matching entries are not necessarily independent corroboration.

As of 11 October, Zero Day Wire has not located a company confirmation or incident-specific technical evidence in the public sources reviewed. The listing does not establish how access was obtained, whether systems were encrypted or which client records, if any, were taken.

There is also an important scope problem. Deloitte describes its network as legally separate, independent member firms and related entities. A listing under the Deloitte name does not, by itself, identify the entity involved or establish a compromise across that network.

EY disclosed a client-data incident

EY's case has a firmer starting point: a company notification filed with California's Attorney General.

EY said an unauthorised party accessed a third-party IT service management platform between 28 March and 12 April 2026 and downloaded documents relating to a number of its clients. The platform supported EY teams carrying out tax work. Support tickets could contain documents with client tax information ;).

EY detected anomalous activity on 23 April. Its notice says affected information included personal information and certain financial information contained in, or used to prepare, tax filings. The company said it investigated with an independent cybersecurity firm, stopped the unauthorised access and notified federal law enforcement.

That is a company-disclosed incident, not just an entry on a criminal website. It is also a specific account of how client documents became exposed through a support platform, rather than evidence that every EY environment was compromised.

There was a later attribution claim. BleepingComputer reported on 27 July that ShinyHunters claimed responsibility and alleged broader access through stolen credentials. The publication could not independently verify those assertions, and reported that EY had not confirmed the attribution at that time. EY's notification does not name the attacker or the platform vendor.

The distinction matters. Neither that notice nor the later ShinyHunters claim establishes a connection to The Gentlemen or a shared campaign against consulting firms.

What is known about The Gentlemen

The uncertainty around Deloitte does not mean The Gentlemen is an invented threat. Microsoft's analysis published on 28 May links the ransomware operation to Storm-2697 and describes a ransomware-as-a-service model in which affiliates carry out attacks.

Microsoft analysed a Go-based encryptor with several ways to spread through a Windows environment, including PsExec, WMI, scheduled tasks and remote services. Its research also documents attempts to disable protection and undermine recovery. The operation combines data theft with encryption to put pressure on victims.

Check Point's incident response report, published on 20 April, describes an investigated intrusion in which an attacker held Domain Admin-level privileges and ultimately deployed The Gentlemen ransomware through Group Policy. The researchers could not conclusively determine the initial access vector in that case.

Those findings describe the threat's capabilities and activity observed elsewhere. They do not establish the attack route, tooling or outcome behind the Deloitte allegation. Attaching a known ransomware family's techniques to an unverified listing would turn useful context into invented incident detail.

Check where client records travel

EY's disclosure shows why the support systems around client work deserve attention. A tax document attached to a ticket can become sensitive data held outside the main application that originally needed it. That creates another place to secure, monitor and investigate.

For organisations handling similar material, the useful response is to follow the records:

• Review what staff attach to support tickets and collaboration tools. Keep sensitive documents in controlled repositories where possible, and minimise unnecessary copies.
• Check which staff, vendors, service accounts and integrations can read or export those records. Permissions in supporting platforms matter as much as access to the main client application.
• Preserve relevant authentication, access and download logs when investigating an extortion claim. Establish the entity and data involved before issuing broad conclusions about client exposure.
• Treat data theft separately from encryption. A successful restore does not tell you whether documents were downloaded or retained by an attacker.
• Review privileged remote execution and recovery controls. Microsoft's guidance for this ransomware includes cloud-delivered protection and tamper protection; changes should be assessed for the organisation's environment.

These are defensive priorities drawn from the disclosed EY incident and published ransomware research, not claims about what happened at Deloitte.

Follow the client records

The Deloitte claim deserves scrutiny. It does not yet justify a confirmed-breach headline or a shared-campaign conclusion.

The lesson is narrower, and more useful: establish which entity is involved, follow where client records are stored and keep reported claims separate from what an investigation actually proves. The difference is not pedantry. It determines who needs to act and what they need to protect.