EY suffers tax data leak via external platform
Ernst & Young disclosed a breach in a third-party system used to manage tax-related support requests, compromising clients' personal and financial documents between late March and mid-April 2026.
Breach in support tool exposes sensitive data
A third-party system used by Ernst & Young (EY) to handle support requests related to its tax services was compromised, leading to the leak of documents containing clients' personal and financial information. The incident, detected on April 23, 2026, prompted the firm to notify affected individuals.
The attackers accessed the platform between March 28 and April 12, 2026, downloading files containing data used for tax return preparation. Exposed information includes names, addresses, Social Security numbers, and banking details.
Intrusion with no claim or apparent exploitation
No cybercriminal group has claimed responsibility for the attack, and EY states it has not identified any attempt to exploit or disseminate the stolen data. Investigations, conducted with the support of a specialized firm, have not determined the intrusion method or the identity of those responsible.
The firm has secured the affected systems and notified U.S. federal authorities. Impacted clients were contacted directly to inform them of the measures implemented.
Support offered to affected clients
EY is offering affected individuals free identity and credit monitoring for two years through the provider Experian. This service, which also includes identity restoration assistance, can be activated until October 31, 2026.
Operating in over 150 countries, EY is one of the world's leading professional services firms, with activities spanning audit, tax advisory, and transactions. The group employs hundreds of thousands of people globally.
Key Points
- EY detected an intrusion in a third-party system used to manage support requests related to its tax services
- Attackers accessed the platform between March 28 and April 12, 2026, downloading documents containing clients' tax information
- Exposed data includes names, addresses, Social Security numbers, and banking information
- No group has claimed the attack, and EY has not identified any exploitation of the stolen data
- The firm is offering affected clients free identity and credit monitoring for 24 months via Experian
Sources
- SecurityWeek - "Ernst & Young Data Breach Affects Personal, Financial Information". (secondary)
- BleepingComputer - "Ernst & Young discloses data breach after support system hack". (secondary)
Transparency: 2 sources (0 primary, 2 secondary). Verification: July 20, 2026.
Truthyx - July 20, 2026