EY Discloses Breach of Third-Party Support Platform Exposing Tax Client Data

Ernst & Young (EY) disclosed a data breach after attackers gained unauthorized access to a third-party IT support and ticketing platform used by EY personnel supporting tax-related client work. EY said the intruders accessed the system between March 28 and April 12, 2026, downloaded multiple documents, and exposed personal and financial information used for tax preparation, including data tied to some individuals’ investment holdings with EY institutional clients. The firm detected anomalous activity on April 23, launched an investigation with external cybersecurity experts, secured affected systems, and notified federal law enforcement.

EY has not disclosed the identity of the third-party vendor, the number of affected individuals, the attack method, or any attribution to a threat actor. The company said it has not found evidence that the stolen information has been misused or that specific individuals were deliberately targeted, and began notifying affected people on July 13. EY also filed breach notifications with the California Attorney General and is offering eligible individuals 24 months of Experian identity monitoring and restoration services.