Ernst & Young Reports Data Breach Linked to Support System Hack
Ernst & Young (EY) has disclosed a data breach involving a third-party support ticket system utilized by its IT personnel. The company has notified clients that support tickets submitted through this platform may have contained documents with sensitive client tax information. EY, one of the largest auditing and professional services firms globally, operates in over 150 countries and employs approximately 406,000 people, reporting a revenue of $53.2 billion last year.
The breach was detected on April 23 when EY noticed anomalous activity on its networks, prompting an investigation. Collaborating with external cybersecurity experts, the firm determined that an unauthorized third party accessed the support system between March 28 and April 12, downloading multiple documents. While the breach notification includes a placeholder for specific data types, the exact nature of the exposed information remains unspecified.
The company has not disclosed the number of clients affected or whether the breach impacts only its U.S. customers or clients in other regions. Following the incident, EY has secured its systems and notified federal law enforcement authorities, assuring that the unauthorized access has been eliminated. The firm has stated that it is unaware of any misuse or further exposure of the compromised files and has no indication that specific individuals were targeted by the attackers.
To address potential risks from this exposure, EY is providing affected clients with 24 months of identity monitoring and restoration services through Experian, encouraging them to enroll by October 31, 2026. As of the latest updates, no data extortion or ransomware groups have claimed responsibility for the breach, and inquiries made by BleepingComputer to EY for additional details have not yet received a response.
