Ernst & Young confirmed a data breach involving theft of personal and financial information from a third-party service management platform used to support tax-related work. The breach occurred between March 28 and April 12, with attackers downloading client tax documents containing sensitive information including Social Security numbers and financial account data. The ShinyHunters extortion group claimed responsibility and has posted the stolen data on their leak site, threatening further exposure. EY is providing affected individuals with credit and identity monitoring services but has not disclosed the breach's full scope or technical details. No information on the exploited vulnerability or patch availability has been provided.

Sensitive personal and financial information of Ernst & Young clients was compromised, including client names, addresses, Social Security numbers, account numbers, and credit/debit card numbers. This exposure increases the risk of identity theft, financial fraud, and privacy violations for affected individuals. The breach affects trust in EY's data handling and third-party platform security. No direct information on operational impact or further exploitation is available.

No patch or remediation details are available since this incident involves a breach of a third-party management platform rather than a disclosed software vulnerability. Ernst & Young is providing affected individuals with 24 months of free credit monitoring, identity monitoring, and identity restoration services. Organizations should review their third-party risk management and incident response processes. Monitor official communications from Ernst & Young and the third-party platform for updates. No immediate action is required beyond what EY is providing to impacted individuals.