Ernst & Young Third-Party Support System Data Breach

Between 28 March and 12 April 2026 an unauthorised party accessed a third-party information technology service management platform used by EY IT staff to support tax-related work for clients. Support tickets on the platform sometimes contained documents with client tax information. EY detected anomalous activity on 23 April 2026, engaged external investigators, and secured the platform. Notifications to affected individuals and state regulators began in mid-July 2026. Exact number of affected individuals has not been publicly disclosed. Exposed data could include names, addresses, dates of birth, Social Security numbers, financial account numbers, credit/debit card information, and other data used in tax filings.

Ernst & Young is one of the 'Big Four' global professional services firms. The incident involved a third-party platform used internally for IT support of tax service delivery.

Compromise of a third-party support ticket / IT service management platform. No public details on the exact initial access method, malware, or threat actor. Access window lasted approximately two weeks before detection.

No public attribution.

Additional victims

• Multiple EY clients whose tax-related documents were present in the support system

Countries affected

• United States

Data types

• PII
• Names
• Addresses
• Dates of birth
• Social Security numbers
• Financial account numbers
• Credit / debit card information
• Tax filing related information

Notification and identity monitoring costs; potential regulatory scrutiny and client impact.

Public reaction

Focus on the sensitivity of tax and financial data and the delayed notification timeline.

Notifications filed with multiple US state attorneys general; federal law enforcement notified. Identity monitoring offered.

Security improvements

• Platform secured after detection
• External forensic investigation
• Client notifications and 24-month identity monitoring via Experian

Significance

Notable third-party breach affecting a Big Four firm’s tax-related client data, underscoring risks in support tooling that handles sensitive documents.

Publishing organisations

• SecurityWeek
• ZDNET
• BleepingComputer
• ClassAction.org

Unauthorised access ended by 12 April 2026. Platform secured after detection on 23 April. Notifications issued from mid-July 2026.

Official documents

• EY client notification letters filed with state attorneys general

References

1. [1]EY notification letters
2. [2]SecurityWeek
3. [3]ZDNET
4. [4]California and Vermont Attorney General filings