Ernst & Young LLP (EY) recently informed its clients about a security breach where unauthorized individuals accessed their IT support system, extracting documents with sensitive client tax information. This cyber incident took place over approximately two weeks in the spring of 2026, raising concerns about data privacy and security.
Details of the Incident
On July 15, 2026, EY reported the breach to the California Attorney General’s office, highlighting the scale of the issue. According to a letter issued by EY on July 13, 2026, the breach involved a third-party IT service management platform. This tool is crucial for EY’s IT staff, assisting them in managing tax-related tasks for clients. The platform’s support tickets often included attachments with sensitive information, a practice that, while common, poses significant risks.
The breach was initially detected on April 23, 2026, when EY noticed unusual activity on the platform. However, investigations revealed that the system had been compromised earlier, between March 28 and April 12, 2026. During this period, attackers managed to download documents related to various EY clients before their activities were discovered.
Implications and Client Data Exposure
The delay in identifying the breach allowed attackers ample time to extract data undetected. The stolen documents contained personal and financial information linked to clients’ investment holdings and tax filings. Despite the severity of the breach, EY has not found evidence suggesting misuse of the exposed data or that specific individuals were targeted.
This incident is distinguished from other security issues EY has faced, including a significant data exposure in October 2025 involving their Italian division’s SQL Server backup. Additionally, in 2023, EY was impacted by the widespread MOVEit Transfer vulnerability, affecting over 30,000 individuals.
Broader Security Challenges
IT service management platforms are increasingly targeted by cybercriminals due to the volume of sensitive attachments they handle. For a global firm like EY, which deals with vast amounts of tax data, a breach in such a system can lead to widespread data exposure, significantly affecting clients and their customers. This not only invites regulatory scrutiny but also affects the firm’s reputation.
As cyber threats continue to evolve, organizations must enhance their security measures to protect sensitive information. EY’s recent breach underscores the need for robust incident response strategies and the importance of securing third-party platforms.
Strengthen your security operations by integrating advanced threat detection and response tools to mitigate such risks effectively.
