Loading story…
Ernst & Young (EY) disclosed a data breach after attackers gained unauthorized access to a third-party IT support and ticketing platform used by EY personnel supporting tax-related client work. EY said the intruders accessed the system between March 28 and April 12, 2026, downloaded multiple documents, and exposed personal and financial information used for tax preparation, including data tied to some individuals’ investment holdings with EY institutional clients. The firm detected anomalous activity on April 23, launched an investigation with external cybersecurity experts, secured affected systems, and notified federal law enforcement.
EY has not disclosed the identity of the third-party vendor, the number of affected individuals, the attack method, or any attribution to a threat actor. The company said it has not found evidence that the stolen information has been misused or that specific individuals were deliberately targeted, and began notifying affected people on July 13. EY also filed breach notifications with the California Attorney General and is offering eligible individuals 24 months of Experian identity monitoring and restoration services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
EY said affected clients would receive 24 months of identity monitoring and restoration services through Experian following the third-party support platform breach. The company also stated it had no evidence at the time that the exposed information had been misused or that specific individuals were targeted.
On July 15, 2026, EY filed breach notifications with the California Attorney General's office regarding the third-party support platform compromise.
EY began notifying affected individuals on July 13, 2026, stating that documents exposed in the incident contained personal and financial information tied to tax preparation and certain investment holdings.
On April 23, 2026, EY detected suspicious or anomalous activity involving the support platform, began investigating the incident, engaged external cybersecurity experts, secured its systems, and notified federal law enforcement.
An unauthorized party accessed a third-party IT support ticket platform used by EY personnel between March 28 and April 12, 2026, and downloaded documents containing personal and financial information used for tax preparation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcecyberveille.ch
Open sourcethecyberthrone.in
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcethecybersecguru.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Erie Family Health Centers, a Chicago-area healthcare provider, disclosed a network intrusion that exposed sensitive personal information and protected health information for more than 570,000 individuals. The organization said an unauthorized third party had access to its network from **December 10, 2025, through January 27, 2026**, when suspicious activity was detected and an investigation began. Impacted data varied by person but included identifiers such as Social Security numbers, financial account information, online credentials, biometric data, and medical treatment, diagnosis, and other health records. Erie said it secured the affected network, brought in third-party digital forensics and cybersecurity experts, notified law enforcement, and reported the incident to the U.S. Department of Health and Human Services Office for Civil Rights. The provider also said it strengthened security controls and is offering affected individuals complimentary credit monitoring and identity theft protection. No threat group had publicly claimed responsibility, and Erie had not disclosed attribution, the amount of data taken, or whether the intrusion involved a ransom demand.
Jun 29, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
A 4TB+ SQL Server backup file belonging to Ernst & Young (EY) was discovered exposed to the public internet due to a cloud storage misconfiguration. The backup, which was unencrypted, contained highly sensitive information including API keys, session tokens, cached authentication tokens, service account passwords, and user credentials. The exposure was identified by Neo Security, whose lead researcher found and partially downloaded the file, confirming the presence of critical secrets. The incident highlights the risks associated with cloud storage misconfigurations, where even brief exposures can be detected and exploited by automated scans. Upon being notified by Neo Security, EY responded promptly and professionally, acknowledging the issue and engaging in clear, technical communication with the researchers. The firm’s incident response was described as "textbook perfect," with the vulnerability triaged and fully remediated within a week. The case underscores the importance of mature security practices and rapid response in mitigating the impact of accidental data exposures, especially when large volumes of sensitive corporate data are at risk.
Jun 29, 2026