Ernst & Young LLP (EY), one of the world’s largest professional services firms, has confirmed that client tax data was exposed after attackers breached a third party IT service management platform used by its tax practice. EY relies on this vendor hosted platform to help its internal IT staff support teams working on tax related client engagements, and support tickets logged there routinely carried attachments containing sensitive client information.EY detected anomalous activity on April 23, 2026, and immediately triggered incident response. The subsequent investigation conducted with an external cybersecurity firm, found that unauthorized access had actually begun on March 28, 2026 and continued until April 12, 2026, meaning attackers had roughly two weeks inside the platform before the intrusion was even noticed. During that window, documents belonging to numerous clients were downloaded, including personal and financial data used for tax preparation and in some cases, information tied to individuals’ investment holdings.
\nEY filed formal breach notifications with the California Attorney General on July 15, 2026, and began mailing notice letters to affected individuals on July 13, 2026. The firm has stated it found no evidence of misuse so far, has secured the affected systems, and has notified federal law enforcement.<\/p>\n
EY’s own network was never compromised. The weak link was a third-party support platform.A category of tool almost every large organization uses for IT ticketing, customer support, or document sharing. This is the pattern behind a growing share of 2026’s major breaches: attackers are increasingly bypassing hardened corporate networks and going after the vendors, contractors, and SaaS platforms that sit just outside them but still hold sensitive data.
\nThree factors made this breach worse than it needed to be:
\n\u2022 Sensitive data drifted into a low scrutiny system. Support tickets became an unofficial repository for tax
\ndocuments, because it was convenient not because anyone decided it should be.
\n\u2022 Detection lagged compromise by nearly a month. Almost three weeks passed between initial access and the first sign of anomalous activity, giving attackers a wide window to operate undetected.
\n\u2022 Vendor risk wasn’t treated as organizational risk. A breach inside a vendor’s platform became a breach of EY’s clients’ data, with EY facing the regulatory and reputational consequences.<\/p>\n
\u2022 Inventory every third party that can touch, store, or transmit sensitive data not just the ones with formal dataprocessing agreements.
\n\u2022 Classify vendors by data sensitivity and access level, and apply proportionally stronger due diligence and
\nmonitoring to the highest risk ones.
\n\u2022 Restrict what sensitive data is allowed to enter vendor platforms in the first place,support tickets and shared drives should not double as document archives.
\n\u2022 Require vendors to demonstrate real controls: MFA, encryption, logging, and incident response commitments and verify them, don’t just take their word for it.
\n\u2022 Shorten detection time with continuous monitoring of vendor connected systems, not just annual questionnaires or one time audits.
\n\u2022 Build a joint incident response plan with critical vendors before an incident happens, including clear notification timelines.<\/p>\n