EY Third-Party Platform Breach Exposes Goldman Sachs and Man Group Client Data

Ernst & Young (EY) disclosed a breach of a third-party IT service management platform supporting its tax practice that exposed personal, tax, and financial information associated with multiple clients, including Goldman Sachs wealth management clients and Man Group. An unauthorized party accessed the platform and downloaded client documents between March 28 and April 12, 2026. EY detected unusual activity on April 23 and first disclosed the incident in July. Goldman Sachs and Man Group said their own systems were not compromised.

EY attributed the incident to a Checkmarx software vulnerability, but publicly available reporting identifies no specific CVE, affected version, or exploitation method. EY engaged an independent cybersecurity firm, notified regulators in four U.S. states, and offered credit monitoring and identity protection services. Goldman Sachs requested objective evidence and third-party verification that EY’s remediation was effective. EY’s July notice reported no evidence of data misuse or deliberate targeting of particular individuals; the incident underscores the need to validate third-party remediation and assess sensitive data held by service providers.