EY Data Breach

Cybersecuritynews •Guru Baran • July 17, 2026

Ernst & Young LLP (EY) is notifying clients that an unauthorized third party breached a support ticket platform used by its IT staff, downloading documents containing client tax data during a roughly two-week window this spring. The Big Four accounting and consulting giant filed breach notifications with the California Attorney General’s office on July 15, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ernst & Young Data Breach Exposes Client Tax Information Ernst & Young LLP (EY) has confirmed a data breach involving unauthorized access to a third-party IT service management platform used for tax-related work. The breach, which occurred between March 28 and April 12, 2026, allowed attackers to exfiltrate sensitive client documents containing personal and financial information. EY filed breach notifications with multiple state attorney generals on July 15, 2026, and began notifying affected clients on July 13, 2026. The breach affected 873 residents in Texas, 480 in Massachusetts, and 13 in Vermont, among others. The exposed data includes names, Social Security numbers, financial account information, and tax-related documents. EY has secured its systems and engaged third-party cybersecurity experts to investigate the incident. They are offering affected individuals 24 months of complimentary identity monitoring services. This incident marks EY's second major data exposure in less than a year. 16 sources 68

Extracted Entities

EY Data Breach

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)