Executive Summary
Ernst & Young (EY), one of the world’s largest professional services firms, has disclosed a data breach following the compromise of a third-party IT support ticket system. The breach, detected on April 23, 2026, allowed an unauthorized third party to access and download documents containing sensitive client tax and financial information between March 28 and April 12, 2026. EY’s investigation, conducted with external cybersecurity experts, confirmed that the attackers exploited the support platform but found no evidence of further misuse or targeted attacks against individuals. The company has secured its systems, notified federal law enforcement, and is offering 24 months of identity monitoring and restoration services to affected clients. At the time of writing, no ransomware or extortion group has claimed responsibility, and the specific method of compromise remains undisclosed.
Technical Information
The breach at Ernst & Young originated from the compromise of a third-party IT service management platform used by EY’s IT personnel to support internal teams handling tax-related client work. This platform, which aggregated support tickets and often included attachments with sensitive client tax information, was accessed by an unauthorized party over a two-week period in spring 2026. The attackers downloaded multiple documents containing personal and financial data used in tax filings.
The specific attack vector has not been publicly disclosed. There is no evidence of malware deployment, ransomware, or extortion, and no technical indicators such as hashes, IP addresses, or domains have been published. The attack window lasted from March 28 to April 12, 2026, before anomalous activity was detected on April 23, 2026.
Based on the available evidence, the most relevant MITRE ATT&CK techniques are:
- T1199 - Trusted Relationship: The attackers exploited a trusted third-party IT support/service management platform to gain access to sensitive data (MITRE ATT&CK T1199). This is the primary confirmed technique, as the breach was facilitated through a platform trusted by EY for internal support operations.
- T1213 - Data from Information Repositories: The attackers collected documents stored in the support ticket system, which aggregated sensitive attachments from multiple clients (MITRE ATT&CK T1213).
- T1020 - Automated Exfiltration: The attackers downloaded multiple documents over a two-week period. While the exact exfiltration method is not detailed, the timing and volume suggest automated processes may have been used.
- T1078 - Valid Accounts and T1190 - Exploit Public-Facing Application are possible but unconfirmed, as there is no direct evidence of credential theft or exploitation of a software vulnerability.
No malware, ransomware, or specific tools have been identified in this incident as of July 17, 2026. No threat actor or group has claimed responsibility, and there are no public technical indicators to support attribution.
Historically, Ernst & Young has experienced other security incidents, including a 2023 breach tied to the MOVEit Transfer vulnerability and a 2025 exposure of a 4TB SQL Server backup. These incidents highlight the ongoing risks faced by large professional services firms, particularly those handling sensitive financial and tax data for institutional clients.
Attackers are increasingly targeting IT service management and helpdesk platforms, as these systems often aggregate sensitive attachments across many clients in a single, sometimes under-secured, third-party environment. For organizations like EY, a single compromised support system can result in widespread exposure, regulatory scrutiny, and reputational damage.
Affected Versions & Timeline
The breach affected the third-party IT service management platform used by Ernst & Young’s IT personnel. The specific platform name and version have not been disclosed. The confirmed timeline is as follows:
March 28, 2026: Start of unauthorized access to the third-party support ticket platform.
April 12, 2026: End of unauthorized access and data exfiltration window.
April 23, 2026: EY detects anomalous activity and initiates incident response.
July 13, 2026: EY issues notification letter to affected clients.
July 15, 2026: Breach notifications filed with the California Attorney General’s office.
July 17, 2026: Public disclosure and media reporting.
The number of affected clients and the specific data types exposed remain undisclosed. The breach potentially impacts clients globally, as EY operates in more than 150 countries.
Threat Activity
The threat activity involved unauthorized access to a third-party IT support/service management platform, followed by the exfiltration of documents containing sensitive client tax and financial information. The attackers operated undetected for approximately two weeks, leveraging the platform’s aggregation of sensitive attachments to maximize data collection.
There is no evidence of malware deployment, ransomware, or extortion. No threat actor or group has claimed responsibility, and there are no indications that specific individuals were targeted. EY’s investigation, conducted with external cybersecurity experts, found no evidence of further misuse or exposure of the stolen files.
The incident is consistent with broader trends in the targeting of IT service management and helpdesk platforms, which are attractive to attackers due to their centralization of sensitive data from multiple clients. The lack of technical indicators and public attribution suggests a focus on data theft rather than extortion or disruption.
Mitigation & Workarounds
The following mitigation steps and workarounds are recommended, prioritized by severity:
Critical: Organizations using third-party IT service management platforms should immediately review access controls, audit logs, and data retention policies. Ensure that sensitive attachments are not routinely included in support tickets unless absolutely necessary, and implement strict data minimization practices.
High: Conduct a comprehensive security assessment of all third-party platforms integrated with internal systems. Require vendors to provide evidence of regular security testing, patch management, and incident response capabilities.
High: Enable multi-factor authentication (MFA) for all accounts accessing support and service management platforms. Regularly review and revoke unnecessary access privileges.
Medium: Implement network segmentation and monitoring to detect anomalous activity within support platforms. Use behavioral analytics to identify unusual data access or exfiltration patterns.
Medium: Provide security awareness training to IT personnel and end users regarding the risks of including sensitive data in support tickets and attachments.
Low: Review and update incident response plans to ensure rapid detection and containment of breaches involving third-party platforms.
EY has offered 24 months of identity monitoring and restoration services to affected clients and has notified federal law enforcement authorities. Organizations should consider similar support for affected individuals in the event of a comparable breach.
Indicators of Compromise
At the time of writing, no public indicators of compromise (IOCs) have been disclosed in connection with this incident. Organizations are advised to monitor for updates from EY and relevant authorities, and to validate any future indicators before enforcement.
References
https://cybersecuritynews.com/ey-data-breach/amp/
About Rescana
Rescana’s Third-Party Risk Management (TPRM) platform enables organizations to continuously assess and monitor the security posture of their vendors and third-party service providers. Our platform provides actionable insights into supply chain risks, supports incident response workflows, and helps organizations identify and mitigate vulnerabilities in third-party platforms and integrations.
We are happy to answer questions at info@rescana.com.
