Organizations entrusted with highly sensitive financial information are increasingly becoming targets for cybercriminals, and even the strongest internal security programs can be undermined through third-party providers. Ernst & Young (EY), one of the world’s largest professional services firms, has disclosed a data breach affecting tax clients after attackers gained unauthorized access to a third-party IT support platform used by its tax practice.
The incident exposed documents containing personal and financial information used for tax preparation, prompting EY to notify affected clients and offer identity protection services.
What Happened?
According to notification letters sent to affected individuals, EY identified suspicious activity involving a third-party information technology service management platform on April 23, 2026. The company immediately launched an internal investigation, engaged an independent cybersecurity firm, and notified federal law enforcement authorities.
Investigators later determined that an unauthorized third party had accessed the external support platform between March 28 and April 12, 2026. During that period, attackers downloaded documents associated with a number of EY tax clients before the activity was detected.
The compromised platform was reportedly used by EY’s IT personnel to manage support requests related to tax engagements. In many cases, support tickets included attachments containing tax documents or information required to troubleshoot client issues. Those files became accessible after the attackers successfully breached the platform.
Although EY has confirmed that documents were downloaded, the company says it has not found evidence that the stolen information has been misused.
What Information Was Exposed?
The exact information affected varies from one individual to another, but EY says the exposed documents contained both personal information and financial data associated with tax preparation.
The notification letters intentionally avoid listing a universal set of exposed data because each affected client had different documents stored within the platform. Instead, each recipient receives a personalized notification identifying the specific information involved in their case.
Depending on the documents stored in support tickets, the exposed information could include details commonly found in tax records and supporting documentation. While EY has not publicly disclosed every category of affected data, it confirmed that the information relates to tax filing activities.
At this time, the firm says it has no indication that any affected individual was specifically targeted or that the stolen information has been used for fraud or identity theft.
📬 Stay Ahead of Cyber Threats
Get the latest cybersecurity news, critical vulnerabilities, threat intelligence, tutorials, and exclusive giveaways delivered straight to your inbox. No spam. Unsubscribe anytime.
Subscribe to the Newsletter →Timeline of the Incident
The currently known timeline paints a picture of an intrusion that remained undetected for several weeks.
- March 28, 2026: Attackers reportedly gained unauthorized access to the third-party support platform.
- March 28 – April 12, 2026: Documents belonging to multiple EY tax clients were accessed and downloaded.
- April 23, 2026: EY detected unusual activity and initiated an incident response investigation.
- July 13, 2026: Notification letters began reaching affected individuals.
Like many modern cyber incidents, there was a gap between the initial compromise and its discovery. Such delays are not uncommon, particularly when attackers quietly access cloud-based platforms instead of deploying disruptive ransomware or malware.
A Third-Party Risk That Continues to Grow
The breach is another reminder that organizations are only as secure as the vendors and service providers they rely upon.
Large enterprises increasingly depend on cloud-based platforms for IT support, customer service, ticket management, collaboration, and document sharing. These systems often contain sensitive attachments that were never intended to become long-term repositories of confidential information, yet they frequently end up storing financial records, identity documents, contracts, and internal communications.
Compromising a third-party service provider can sometimes provide attackers with access to valuable information from multiple organizations simultaneously, making supply chain and vendor-related attacks an increasingly attractive target.
EY has not identified the vendor involved in this incident, nor has it explained how the attackers initially gained access to the platform. The company has also not disclosed whether the compromise resulted from stolen credentials, a software vulnerability, or another attack vector.
EY’s Response
Following the discovery of the breach, EY says it took immediate steps to contain the incident and secure the affected environment.
The company initiated an internal investigation, retained external cybersecurity specialists to assist with forensic analysis, and worked to stop the unauthorized access. Federal law enforcement agencies were also notified.
In addition, EY is providing 24 months of complimentary Experian IdentityWorks credit monitoring and identity restoration services to eligible individuals. Clients who received notification letters can enroll using the activation code included in their correspondence before October 31, 2026.
While the investigation remains ongoing, EY states that it continues to monitor the situation for any signs that the stolen information is being misused.
What Should Affected Individuals Do?
Although there is currently no evidence that the exposed information has been exploited, incidents involving tax data deserve careful attention because financial records can remain valuable to attackers long after they are stolen.
Individuals who receive an official notification from EY should review the information provided in their letter to understand exactly what data was involved. It is also advisable to monitor bank accounts, credit card statements, and tax-related activity for anything unusual over the coming months.
Taking advantage of the complimentary identity monitoring service offered by EY can provide an additional layer of protection, particularly if sensitive personal information was included in the exposed documents. Users should also remain alert for phishing emails or phone calls that reference tax matters, as cybercriminals often use information from data breaches to make scams appear more convincing.
Where appropriate, placing a fraud alert or credit freeze with major credit bureaus may also help reduce the risk of identity fraud.
Many Questions Remain Unanswered
Despite publicly acknowledging the breach, several important details remain unknown.
EY has not disclosed how many individuals were affected, making it difficult to understand the overall scale of the incident. The company has also not confirmed whether the breach is limited to U.S. clients or extends to customers in other regions where EY operates.
Equally significant is the absence of information about the attackers themselves. No ransomware or data extortion group has claimed responsibility, and EY has not attributed the intrusion to any known threat actor. The identity of the third-party service provider involved has also not been revealed.
As investigations continue, additional technical details may emerge that provide greater clarity into how the compromise occurred and whether similar organizations face comparable risks.
Final Thoughts
The EY incident highlights a challenge that continues to confront organizations across every industry: protecting sensitive information no longer depends solely on securing internal systems. Third-party platforms have become an integral part of day-to-day operations, and they often hold the same valuable data that attackers seek from primary networks.
For businesses handling tax records, financial documents, and personally identifiable information, vendor security must be treated as an extension of their own cybersecurity program. Strong access controls, data minimization, continuous monitoring, and careful oversight of external service providers are becoming just as important as defending corporate infrastructure itself.
While EY says there is currently no evidence that the exposed information has been misused, the breach serves as another reminder that supply chain compromises remain one of the most persistent and difficult cybersecurity challenges facing organizations today.
