EY Data Breach – Hackers Access Third

Gbhackers •Eswar • July 18, 2026

Ernst & Young LLP (EY) has confirmed a data security incident in which an unauthorized third party breached a third-party IT service management platform used by its tax practice, exfiltrating documents containing client personal and financial information. The Big Four firm filed formal breach notifications with the California Attorney General’s office on July 15, 2026, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ernst & Young Data Breach Exposes Client Tax Information Ernst & Young LLP (EY) has confirmed a data breach involving unauthorized access to a third-party IT service management platform used for tax-related work. The breach, which occurred between March 28 and April 12, 2026, allowed attackers to exfiltrate sensitive client documents containing personal and financial information. EY filed breach notifications with multiple state attorney generals on July 15, 2026, and began notifying affected clients on July 13, 2026. The breach affected 873 residents in Texas, 480 in Massachusetts, and 13 in Vermont, among others. The exposed data includes names, Social Security numbers, financial account information, and tax-related documents. EY has secured its systems and engaged third-party cybersecurity experts to investigate the incident. They are offering affected individuals 24 months of complimentary identity monitoring services. This incident marks EY's second major data exposure in less than a year. 16 sources 68

Extracted Entities

EY Data Breach – Hackers Access Third

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)