EY Investigates Third-Party Data Breach
Hackers accessed EY client tax information through vendor system.
1EY's Disclosure
Ernst & Young (EY) announced that a third-party IT support system was hacked, compromising client tax documents stored there. The incident came to light on April 23, 2026, when abnormal activity was detected. The company immediately activated cybersecurity protocols.
2Breach Scope
Investigators found unauthorized access to the platform between March 28-April 12, 2026, with multiple client documents downloaded. The compromised data includes personal and financial information. The number of affected clients remains undisclosed.
3EY's Response
EY launched an investigation with an independent cybersecurity firm. Unauthorized access was blocked and systems secured. The company notified federal authorities and will offer 24 months of identity monitoring services to affected clients.
4Risk Assessment
EY emphasized no evidence of misuse of stolen data has been found. However, clients were advised to take additional protective measures. No ransomware group has claimed responsibility for the attack.
5EY's Position
As one of the Big Four professional services firms operating in 150+ countries with 406,000 employees and $53.2 billion revenue, EY remains a high-value target due to its access to sensitive client data.
6Industry Implications
This incident highlights third-party security risks in professional services. Firms handling sensitive data like tax advisory must reassess supply chain security. EY's reputation management challenge begins.
Original article: Security Affairs — EY'de Üçüncü Taraf Veri İhlali Araştırması