EY data breach exposes client tax records after third-party platform hack

Ernst & Young (EY), an accounting and professional services firms, has confirmed a data breach involving a third-party IT support platform that exposed sensitive client tax documents and financial information.

The unauthorized access occurred between March 28 and April 12, 2026, when an attacker gained entry to an information technology service management (ITSM) platform used by EY’s internal support teams. The intruder downloaded documents associated with multiple clients, including files containing personal and financial information used in tax preparation.

• Ernst & Young confirmed that attackers accessed a third-party IT support platform between March 28 and April 12, 2026, downloading documents containing sensitive client tax and financial information.
• EY detected suspicious activity on April 23 but began notifying affected clients in July, with some notifications reportedly continuing into September. The total number of affected individuals remains undisclosed.
• Goldman Sachs and Man Group have been identified among clients associated with exposed information, while cybersecurity reporting has linked the incident to Checkmarx software.

EY identified suspicious activity on April 23, approximately 11 days after the unauthorized access period ended. The firm began sending breach notifications in July, with at least one letter dated July 13. Additional notifications reportedly continued into September.

The company has not disclosed how many clients, individuals or documents were affected. It has also not publicly identified the provider responsible for operating the compromised support platform.

The incident has prompted scrutiny of EY’s cybersecurity controls, its handling of confidential client information and the time taken to notify affected individuals.

How hackers accessed EY’s third-party IT support platform

The breach involved an ITSM platform used by EY’s technology personnel to provide support to employees performing tax-related work for clients.

Such systems manage internal support requests, document technical problems and track assistance provided to employees. Support tickets can also contain attachments submitted by staff to explain or resolve operational issues.

In EY’s case, some attachments contained confidential client information, including documents associated with tax filings and financial records.

According to the firm’s disclosures, an unauthorized third party accessed the platform and downloaded documents belonging to multiple clients during the March 28 to April 12 intrusion period.

The affected system was a third-party technology platform rather than EY’s principal tax or audit software. This distinction is significant because the attack demonstrates how sensitive information can become accessible through support infrastructure that performs functions outside an organization’s primary business applications.

Although the platform was intended for internal technical assistance, the presence of client documents in support tickets meant that unauthorized access could expose information ordinarily subject to strict confidentiality requirements.

TechRadar and other cybersecurity publications reported in July that the breach involved a third-party support-ticket system.

Subsequent reporting in October connected the incident to a security vulnerability involving Checkmarx software.

EY has not publicly confirmed the identity of the platform provider, and the reported Checkmarx connection should be distinguished from the company’s own disclosures.

The October reporting also does not establish that the relevant vulnerability remained unpatched after the intrusion was discovered.

EY data breach timeline: March intrusion to September notifications

The chronology of the incident has attracted attention because several months passed between the initial unauthorized access and the notification of affected clients.

The sequence begins on March 28, 2026, when the attacker first gained access to the IT support platform, according to EY’s investigation.

Unauthorized access continued until April 12, covering approximately 15 elapsed days.

During that period, the intruder downloaded documents associated with EY clients. The company has not provided a detailed public account of how the files were selected or how much information was extracted.

On April 23, EY detected anomalous activity and initiated an investigation into the security incident.

The company subsequently established the period of unauthorized access and began identifying the affected client information.

Breach notifications started in July, approximately three months after the intrusion ended. One notification letter was dated July 13, 2026, placing the interval between detection and notification at approximately 81 days.

Accounting Times and other publications also identified July 13 as an important notification date.

Cybersecurity Intelligence subsequently reported that additional client notifications were being issued as late as September, potentially extending the interval between detection and notification to more than five months for some recipients.

The duration of the notification process raises questions about how quickly the firm identified affected records and determined which individuals required notification.

The timeline alone does not establish whether EY violated any applicable disclosure requirements. Legal obligations depend on the jurisdiction, the nature of the compromised information and when an organization becomes aware of a reportable breach.

What personal and financial information was exposed?

EY confirmed that the compromised documents may have contained personal and financial information associated with client tax filings.

Information identified as potentially exposed in breach notifications and related reporting includes names, residential addresses, Social Security numbers, tax identification numbers, financial account details, credit and debit card information, investment holdings and records used to prepare tax returns.

The specific information affected differs between individuals, depending on which documents were stored in the compromised support platform.

The exposure of Social Security numbers and tax identifiers creates potential identity theft and tax fraud risks.

Financial account details and payment card information may also be useful to criminals seeking to conduct unauthorized transactions or impersonate account holders.

Investment information and other financial records can provide additional details about an individual’s assets and financial relationships.

Because tax preparation records often contain several categories of personal and financial information, a single compromised document may reveal considerably more than basic contact information.

EY has not disclosed how many individuals had each category of information exposed. The firm has also stated that it is not aware of any misuse of the compromised personal information.

That statement is separate from the confirmed unauthorized downloading of client documents and does not establish that every exposed record has been publicly identified.

Goldman Sachs and Man Group linked to compromised information

Reporting has identified Goldman Sachs and Man Group among EY clients whose associated individuals may have been affected by the breach.

The Financial Times reported on the connection in October 2026, describing the exposure of information held by EY in the course of providing professional services.

Neither Goldman Sachs nor Man Group was identified as the direct target of the intrusion.

Instead, the information was held by EY as part of its client relationships and became exposed through the compromised support platform. This distinction matters when assessing responsibility for the security incident.

A breach involving information supplied to a professional services provider does not necessarily mean the original client’s own technology infrastructure was compromised.

In the case of Man Group, a subsequent correction issued by law firm Edelson Lechtzin clarified that the incident occurred at EY, not within Man Group’s systems. The correction identified 19 affected individuals in Massachusetts whose information had been provided to EY through a service relationship.

EY issued notifications to affected individuals on Man Group’s behalf. The publicly identified clients do not represent an exhaustive list of organizations affected by the incident. EY has acknowledged that documents associated with a number of clients were downloaded but has not provided a comprehensive count.

The total exposure therefore remains uncertain, both in terms of affected organizations and the number of individuals whose information was contained in the compromised records.

Third-party cybersecurity risks extend to professional services firms

The EY incident illustrates the security risks associated with storing confidential client information in systems operated or supported by external technology providers.

Professional services firms routinely process financial statements, tax records, investment information and other sensitive documents received from corporate and individual clients.

These records may circulate through supporting business applications during ordinary operations, including internal technical support systems.

When employees attach confidential documents to IT support tickets, information originally collected for accounting or advisory work may become accessible through a separate technology environment.

The resulting exposure can affect individuals and organizations that have no direct relationship with the compromised technology provider.

This category of risk is commonly associated with third-party or supply-chain cybersecurity incidents, although the precise technical route used to compromise EY’s platform has not been fully established in the firm’s public disclosures.

The incident demonstrates that protecting primary financial systems does not necessarily prevent sensitive information from being exposed through connected operational tools.

It also raises questions about the security controls governing ticket attachments, access permissions, data retention and monitoring of third-party platforms.

Legal scrutiny follows EY’s disclosure of the incident

The breach has attracted attention from law firms examining potential claims involving the exposure of personal and financial information.

In July 2026, Edelson Lechtzin LLP announced an investigation into possible class action claims arising from the incident.

The firm identified potentially compromised client tax records as the basis for examining whether affected individuals had suffered legally actionable harm.

The possibility of litigation adds another dimension to EY’s response, although an investigation or allegation does not establish wrongdoing.

EY breach investigation leaves key questions unresolved

Several material details remain undisclosed months after the initial intrusion.

EY has not publicly identified the exact number of clients or individuals affected, the total volume of documents downloaded or the full distribution of compromised information across client organizations.

The firm has also not formally identified the third-party platform provider in its breach disclosures.

Reporting has connected the incident to Checkmarx software, but that attribution remains distinct from EY’s publicly confirmed account of the intrusion.

The company maintains that it is not aware of misuse of the exposed personal information, while its notifications acknowledge that client documents were downloaded without authorization.

The March 28 to April 12 access period, April 23 detection date and subsequent notifications establish the principal sequence of events.

The remaining questions concern the scale of the exposure, the specific information affected and the legal implications of the incident and notification process.

For EY and its clients, the confirmed breach demonstrates how confidential financial and tax records can be exposed through internal support systems even when the original documents were collected for entirely different business purposes.