BUSINESS

New York auditor EY reports major client data breach

▪

Read, Watch or Listen

Ernst & Young (EY) has disclosed a significant data breach affecting its tax practice after hackers compromised a third-party IT service management platform used for internal support. According to breach notifications filed with the California and Vermont Attorneys General on July 18, 2026, an unauthorized party accessed the external ticketing system between March 28 and April 12, 2026, exfiltrating documents containing clients’ personal and financial tax information. EY detected anomalous activity on April 23, 2026, launched incident response procedures, and hired an independent cybersecurity firm. The firm is notifying affected clients and has informed federal law enforcement while the investigation continues.

Prepared by Christopher Adams and reviewed by editorial team.

Timeline of Events

Mar 28 2026 Hackers access third-party support platform
Mar 28 2026–Apr 12 2026 Attackers exfiltrate sensitive client documents
Apr 12 2026 Unauthorized access period reportedly ends
Apr 23 2026 EY detects anomalous platform activity
Apr 23 2026 EY initiates formal incident response
Late April 2026 Independent cybersecurity firm begins investigation
Jul 18 2026 Notifications filed with California Attorney General
Jul 18 2026 Notifications filed with Vermont Attorney General

Why This Matters to You

This breach at EY could affect your privacy if you're a client. Personal and financial tax details were stolen. Check your accounts for suspicious activity. Consider credit monitoring services for extra safety.

The Bottom Line

Data breaches can happen even to big firms like EY. They're taking steps to manage the situation, but the damage is done. It's a reminder that our personal data is always at risk. Worth forwarding if you know someone who uses EY.