Ernst & Young discloses data breach after third-party IT platform compromised

Ernst & Young has notified clients of a data breach after an unauthorized party gained access to a third-party information technology service management platform the firm relies on to support its tax practice.

The London-headquartered firm disclosed the incident in a filing with the California Department of Justice, stating that the compromised platform helps EY’s technology staff assist teams working on client tax matters. Support tickets submitted through the system frequently include attached files, and those files may have contained personal and financial information tied to clients’ tax filings.

EY said it first identified anomalous activity on the platform on April 23, 2026, prompting its information security team to launch an incident response effort. The subsequent investigation determined that an unauthorized third party had accessed the system between March 28 and April 12, 2026, downloading documents belonging to a number of EY clients. The firm has not disclosed how many individuals were affected or named the vendor that operated the breached platform.

The company said it worked with an outside cybersecurity firm to confirm that the unauthorized access has been stopped and that its systems are now secure. EY stated it has found no evidence that the exposed information has been misused or further disclosed, and said nothing indicates that any particular individual’s data was specifically targeted in the intrusion.

To assist affected clients, EY is offering 24 months of identity monitoring and restoration services through Experian IdentityWorks.

No group has claimed responsibility for the breach, and EY has not said whether ransomware played a role in the incident or identified those responsible.

The firm was previously caught up in the widespread Cl0p ransomware group’s exploitation of the MOVEit file transfer software, an incident in which EY said more than 30,000 Bank of America customers had their financial account information and credit card numbers exposed.

Ernst & Young is one of the Big Four global professional services networks, alongside Deloitte, PwC and KPMG, offering audit, tax, consulting, cybersecurity and transaction advisory services. The firm operates in more than 150 countries and employs roughly 406,000 people, reporting global revenue of approximately $53.2 billion for fiscal year 2025.