Ernst & Young Breach: Third-Party IT Support Platform Compromise Exposes Client Tax Data

Ernst and Young, one of the world largest professional services and consulting firms, has disclosed a data breach following the compromise of a third party IT support ticket system. The breach exposed sensitive client tax and financial information over a roughly two week period.

The Breach Timeline

The breach was detected on April 23, 2026, but the unauthorized access had occurred earlier, between March 28 and April 12, 2026. During this window, an unauthorized third party accessed and downloaded documents containing sensitive client tax and financial information through a third party IT service management platform used by EY IT personnel to support internal teams handling tax related client work.

EY filed breach notification letters with the California Attorney General office on July 15, 2026, dated July 13, 2026, confirming the incident scope. The firm uses a third party platform for IT support and service management, a common practice in large enterprises. The breach originated from the compromise of that platform rather than EY own infrastructure.

The Third Party Risk Epidemic

The EY breach is the latest in a growing wave of third party supply chain compromises. The pattern is consistent. Attackers target a vendor or service provider that has trusted access to a larger organization systems, using that trusted relationship as a bridge to reach sensitive data. In this case, the IT support ticketing platform held sensitive documents because EY IT teams used it to manage support requests related to client tax work.

What makes this particularly damaging is the type of data exposed. Tax and financial information is among the most sensitive data a consulting firm handles. It can include client financial statements, tax returns, audit workpapers, and personally identifiable information for client employees. This data is valuable for identity theft, financial fraud, and corporate espionage.

Attribution and Method

At the time of disclosure, no ransomware or extortion group had claimed responsibility for the breach. The specific method of compromise, how the attacker gained access to the third party platform, remains undisclosed. EY has not revealed the exact number of individuals or clients affected.

The Big Four Target Profile

As a Big Four accounting firm, EY handles enormous volumes of confidential client data across thousands of enterprise clients. A breach of this nature has cascading implications. Affected clients may face their own regulatory obligations, the compromised data could be leveraged in targeted attacks against EY clients, and trust in the professional services sector takes a hit. The incident highlights that even organizations with sophisticated cybersecurity programs are only as secure as their weakest third party link.