EY Data Breach: Tax Documents in a Support Ticket Platform

BleepingComputer reported on July 17, 2026 that Ernst and Young disclosed a breach of a third-party support ticket platform used by its IT staff. The attacker downloaded documents attached to tickets between March 28 and April 12, 2026, and EY detected the activity on April 23. Further notices in late September identified affected clients of Goldman Sachs wealth management, Man Group, and Tishman Speyer, according to reports.

Reported data types include names, addresses, dates of birth, Social Security numbers, driver's licence numbers, email addresses, phone numbers, and financial account and card information related to tax filings. Goldman Sachs and Man Group said their own systems were not compromised.

EY had not disclosed a total. Secondary aggregators cited state filings showing relatively small counts in several states; these could not be confirmed directly in the reporting reviewed.

BleepingComputer reported in July that no group had claimed the breach. BleepingComputer reported on July 27, 2026 that the ShinyHunters extortion group had claimed responsibility, while stating it could not verify the claim independently. EY has not confirmed it, so treat the attribution as a claim rather than an established fact.

IT support tickets often accumulate attachments: screenshots, exported files, and documents users share to explain a problem. Over time, ticketing systems become unplanned stores of sensitive data, with weaker controls than the systems the data came from.

Discourage attaching sensitive documents to tickets, use secure links with expiry instead, scan attachments for sensitive data, set retention policies that delete old attachments, and restrict who can view ticket contents. Treat the ticketing platform as part of the data estate.

Professional services firms depend on many SaaS vendors. Contracts should cover security standards, breach notification, and audit rights, and firms should monitor vendor platform logs where possible. The vendor in this incident was not named publicly.

Eleven days elapsed between the end of access and detection, and months between detection and client notifications. Monitoring for bulk attachment downloads would have shortened the first gap; scoping client-by-client takes time in professional services because data belongs to many organisations.

Clients of affected financial firms received notices even though those firms' systems were not breached. Professional services breaches ripple across many organisations, each with its own notification duties and customer relationships.

According to reporting, EY notified law enforcement and offered 24 months of credit monitoring, with an enrolment deadline of October 31, 2026, and said there was no evidence of misuse.

The platform vendor, total affected individuals, and the actor responsible had not been publicly confirmed.

Enrol in the offered monitoring before the deadline, consider a credit freeze, and watch for tax-related fraud, including fraudulent tax returns filed in your name.

Ban sensitive documents in tickets, scan and redact attachments, delete them after resolution, restrict access by role, monitor bulk downloads, and include the ticketing vendor in incident response planning.

Accounting, legal, and consulting firms hold sensitive data for many clients at once. A breach at one firm becomes a breach notice for clients across industries, each managing their own customer relationships. Clients should include their advisers in third-party risk reviews.

Ticketing platforms log attachment downloads and API access. Alerts on bulk downloads, new API tokens, and access by unusual accounts would surface this kind of theft. Many organisations never connect these logs to security monitoring.

Attachments in resolved tickets rarely need to exist years later. Automatic deletion of attachments after a short period would have shrunk what this attacker could download. Retention policies are among the cheapest breach-limiting controls available, yet ticketing platforms often keep everything forever by default.

Treat ticketing platforms as sensitive data stores: restrict attachments, delete them after use, monitor downloads, and include the vendor in incident planning.

Ask your advisers which platforms hold your documents, how long they keep them, and how they would notify you of a breach. Share documents through secure portals with expiry rather than email attachments that end up in tickets and inboxes.

Access March 28 to April 12, detection April 23, public reporting July 17, further notices late September 2026.