Ernst & Young Investigates Data Breach Linked to Third-Party Support System

Ernst & Young (EY) is currently investigating a data breach associated with a third-party support ticket system utilized by its IT teams. This platform, which is designed to assist EY personnel in managing tax-related support requests, was found to have been compromised, potentially exposing documents that include sensitive client tax information. The breach was detected on April 23, 2026, when EY identified unusual activity within the system. Following this discovery, EY's Information Security team promptly activated its incident response protocol to assess the situation, contain the breach, and initiate recovery efforts. The firm has engaged an independent cybersecurity firm to assist in the investigation and ensure that unauthorized access has been halted, confirming that their systems are now secure. According to EY's findings, an unauthorized third party accessed the platform and downloaded various documents between March 28 and April 12, 2026. The compromised data reportedly includes personal and financial information relevant to tax filings. As of now, the number of clients affected by this incident has not been disclosed. EY has taken steps to notify federal authorities and has assured clients that there is no evidence of misuse of the exposed information or targeted attacks against individuals. The company stated, "At this time, we are not aware of any misuse or further exposure of your personal information as a result of this incident. Further, we do not have any indication your personal information was specifically targeted." To assist clients who may be impacted, EY is providing 24 months of identity monitoring and restoration services through Experian. As of now, no ransomware group has claimed responsibility for the breach, and the investigation is ongoing.