EY Data Breach \u2013 Hackers Gain Access to IT Support System and Download Documents
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Ernst & Young LLP (EY) is notifying clients that an unauthorized third party breached a support ticket platform used by its IT staff, downloading documents containing client tax data during a roughly two-week window this spring.<\/p>\n
The Big Four accounting and consulting giant filed breach notifications with the California Attorney General\u2019s office on July 15, 2026, confirming the incident\u2019s scope.<\/p>\n
According to EY\u2019s notification letter dated July 13, 2026, the firm uses a third-party IT service<\/a> management platform to help its information technology personnel support internal teams handling tax-related client work. <\/p>\n Support tickets submitted through this platform routinely included attachments containing sensitive client tax information, a common but risky practice in enterprise IT support workflows.<\/p>\n EY identified anomalous activity within the platform on April 23, 2026, and immediately triggered its incident response procedures. Working with an independent cybersecurity firm, EY\u2019s investigation determined that an unauthorized third party had actually accessed the platform earlier between March 28, 2026, and April 12, 2026, and downloaded documents pertaining to a number of EY clients before the intrusion was detected.<\/p>\n That gap of roughly three weeks between initial compromise and detection meant attackers had a substantial window to exfiltrate data undetected.<\/p>\n The compromised documents contained personal information tied to individuals\u2019 investment holdings with EY\u2019s institutional clients, along with financial information used in preparing tax filings.<\/p>\n EY\u2019s letter said that<\/a> it has no current evidence of misuse of the exposed data or indication that specific individuals were deliberately targeted. <\/p>\n Notably, this incident is separate from other recent EY security lapses, including a 4TB SQL Server backup<\/a> exposure tied to EY\u2019s Italian entity that was disclosed in October 2025 after researchers found it publicly accessible on Azure storage.<\/p>\n EY previously suffered a breach in 2023 tied to the mass-exploited MOVEit Transfer<\/a> vulnerability affecting over 30,000 individuals.<\/p>\n Attackers increasingly target IT service management and helpdesk platforms because support tickets often aggregate sensitive attachments across many clients in a single, sometimes under-secured, third-party environment.<\/p>\n For a firm like EY that processes tax data for financial institutions globally, a single compromised support system can cascade into exposure affecting numerous downstream clients and their end customers, amplifying both regulatory scrutiny and reputational fallout.<\/p>\n \u00a0Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations.\u00a0->\u00a0Integrate ANY.RUN With Your SOC\u00a0<\/a>Now<\/a><\/strong>.<\/strong><\/p>\n The post EY Data Breach \u2013 Hackers Gain Access to IT Support System and Download Documents<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nEY Data Breach<\/strong><\/h2>\n