Ernst & Young experienced a data breach due to the compromise of a third-party support ticket system used internally by its IT staff. Unauthorized access was confirmed for a period spanning approximately two weeks in early 2026, during which multiple documents containing sensitive client tax-related information were downloaded. EY detected anomalous activity on April 23 and engaged external cybersecurity experts to investigate. The breach involved personal and financial data related to tax filings, but specific data types and the number of affected clients remain undisclosed. EY has taken remediation steps by securing the affected systems and notifying federal authorities. They are providing identity monitoring services to impacted clients. No evidence currently suggests exploitation beyond data theft or targeted attacks. The vendor of the compromised third-party system and patch status have not been disclosed.

The breach exposed sensitive client data, including personal and financial information used for tax filings, potentially risking client privacy and financial security. The exact scale and geographic impact are unknown. EY has not reported any misuse or further exposure of the stolen data. The incident may lead to identity theft or fraud risks for affected clients, which EY is mitigating by offering identity monitoring services. There is no indication of ransomware or extortion related to this breach.

EY has secured the compromised systems and removed unauthorized access. They have notified federal law enforcement and are providing affected clients with 24 months of identity monitoring and restoration services through Experian. Clients are urged to enroll in these services by October 31, 2026. No additional mitigation steps are publicly recommended at this time. Patch status for the third-party support system is not disclosed; check with EY or the third-party vendor for updates.