Ernst & Young (EY) has disclosed a significant data breach affecting its tax practice after hackers compromised a third-party IT service management platform used for internal support. According to breach notifications filed with the California and Vermont Attorneys General on July 18, 2026, an unauthorized party accessed the external ticketing system between March 28 and April 12, 2026, exfiltrating documents containing clients’ personal and financial tax information. EY detected anomalous activity on April 23, 2026, launched incident response procedures, and hired an independent cybersecurity firm. The firm is notifying affected clients and has informed federal law enforcement while the investigation continues.

Prepared by Christopher Adams and reviewed by editorial team.