Ernst & Young’s data breach just got bigger, and it now has a name attached to the victims. Letters sent to affected individuals in late September 2026 confirmed that people linked to Goldman Sachs and Man Group were among those whose information was taken when an unauthorized party broke into a third-party IT support platform used by EY’s tax teams, according to Cybersecurity News. The disclosure marks a significant escalation from EY’s original July notice, which described the incident only in general terms as affecting “a number of EY clients.”
EY first disclosed the breach in July 2026, and tech-insider.org covered that initial filing when it surfaced. What’s changed since then is the scope: a named threat actor has stepped forward to claim credit, a law firm has opened a class-action investigation, and two marquee financial institutions are now tied to the exposed records. For a firm whose entire business rests on being trusted with other companies’ most sensitive financial data, the expanding fallout is a reputational problem as much as a technical one.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
How the EY Data Breach Unfolded: A Timeline
The mechanics of the EY data breach are now reasonably well documented across multiple outlets, even though key details, including the identity of the compromised platform vendor, remain unconfirmed. According to Rescana’s incident analysis, an unauthorized party accessed a third-party information technology service management platform, commonly called an ITSM or support-ticket system, that EY’s internal IT staff used to support teams handling client tax work.
The access window ran from March 28 through April 12, 2026, though CFO.com’s reporting cites a slightly earlier start date of March 26 based on EY’s own notice. Either way, the intruder spent roughly two weeks inside the system before EY noticed anything wrong. That detection came on April 23, 2026, more than three weeks after the unauthorized access reportedly stopped. EY then brought in an outside cybersecurity firm to investigate, a step confirmed by Security Affairs.
| Date | Event | Source |
|---|---|---|
| March 26–28, 2026 | Unauthorized access to the ITSM platform begins | Rescana, CFO.com |
| April 12, 2026 | Unauthorized access window ends; documents already downloaded | Rescana |
| April 23, 2026 | EY detects anomalous activity on the platform | Cybersecurity News |
| July 13, 2026 | Date listed on EY’s client notification letter | Cybersecurity News |
| July 15, 2026 | EY files breach notification with the California Attorney General | Cybersecurity News |
| July 17, 2026 | Breach becomes public via multiple outlets | Cybernews, Security Affairs |
| Late July 2026 | ShinyHunters publicly claims responsibility for the intrusion | Datapath newsletter |
| Late September 2026 | New letters confirm Goldman Sachs and Man Group client exposure | Cybersecurity News |
Goldman Sachs, Man Group Clients Named in Expanded Notice
The September letters represent the first time EY has tied specific institutional names to the breach. Cybersecurity News reported that the new round of notifications described individuals connected to Goldman Sachs and Man Group as among those whose personal and financial information was exposed. Both firms are major players in investment banking and asset management, and their inclusion suggests the compromised support-ticket platform held documents tied to high-value client relationships, not just routine individual tax filings.
Neither Goldman Sachs nor Man Group has been reported as having had its own systems breached. The exposure appears to run through EY’s own infrastructure and the documents its tax practice generated while serving clients connected to those institutions. That distinction matters: this is not a Goldman Sachs breach or a Man Group breach, it is an EY breach that happened to touch data associated with people who do business with those firms. It is the kind of indirect, vendor-side exposure that has become a defining feature of 2026’s breach landscape, similar in shape to the pattern seen when Snowflake customer-data exposure rippled across roughly 165 companies earlier this year.
What Data Was Actually Exposed
The categories of exposed data, as described in the Datapath newsletter’s review of the EY notifications and in Cybersecurity News’ coverage, go well beyond names and addresses. Support tickets on the compromised platform reportedly included attachments containing tax filing information, Social Security numbers, bank account numbers, and credit and debit card numbers, alongside documents describing investment holdings and institutional client relationships.
| Data Category | Reported Detail |
|---|---|
| Names and home addresses | Included in affected support-ticket attachments |
| Social Security numbers | Confirmed in exposed documents per Datapath newsletter |
| Bank account numbers | Present in financial documents tied to tax preparation |
| Credit and debit card numbers | Confirmed exposed per Datapath newsletter |
| Tax filing and financial information | Core content of the compromised support tickets |
| Investment holdings and institutional-client documents | Tied to the Goldman Sachs and Man Group disclosures |
It is worth stressing what the reporting does not establish. None of the outlets reviewed have published a confirmed total count of affected individuals or records. EY’s own notification reportedly refers only to “a number of” clients, and the available sources do not establish that every listed data type was present for every affected person. Anyone citing a specific victim count for this incident is going beyond what has actually been confirmed.
ShinyHunters Enters the Picture
According to the Datapath newsletter, the extortion group ShinyHunters publicly claimed responsibility for the EY intrusion in late July 2026, weeks after EY had already filed its breach notification. ShinyHunters has been one of the most active extortion brands of the year, and tech-insider.org has tracked the group’s broader run of claimed breaches across multiple sectors. The group has also surfaced in connection with separate incidents, including a claimed hit against FBI-linked job portal infrastructure.
A public claim of responsibility is not the same as independent attribution. EY’s own notification, per Rescana and Security Affairs, did not name a threat actor, and none of the sources reviewed describe EY or an independent forensics firm confirming ShinyHunters as the responsible party. What can be said is that a group with a well-documented pattern of targeting SaaS platforms and support systems has stated publicly that it was behind this specific intrusion, and that claim has not been publicly disputed by EY.
EY’s Response: What the Firm Has Said
EY’s public posture has been narrow and procedural. Per Rescana’s analysis and Security Affairs’ reporting, the firm’s notification describes using a third-party ITSM platform to support IT personnel working with tax teams, confirms the access window, states that documents tied to a number of clients were downloaded, and confirms that EY engaged an independent cybersecurity firm and contained the activity. The notification does not name the vendor whose platform was compromised, and no outlet reviewed has independently identified that vendor either.
That silence on vendor identity is becoming a pattern worth watching across 2026’s breach disclosures generally. When the compromised system belongs to a supplier rather than the primary company, the affected firm often has limited ability, or limited incentive, to name that supplier publicly while contracts and liability questions are still being sorted out. It leaves regulators, class-action attorneys, and affected individuals without a clear picture of where the actual control failure occurred.
Regulatory Fallout: California AG Filing and What Comes Next
EY’s July 15, 2026 filing with the California Attorney General’s office is the only confirmed regulatory touchpoint reported so far, per Cybersecurity News. California’s breach notification law requires companies to report incidents affecting residents above a certain threshold, and the filing is what first made the basic shape of the breach public. The sources reviewed do not report filings with other state attorneys general, though multistate notification is common in incidents of this scale and additional filings would not be surprising as EY’s review of affected individuals continues.
No sources reviewed report a fine, a settled enforcement action, or a confirmed regulatory penalty against EY tied to this incident. That is consistent with the normal timeline for breach-related regulatory action, which typically lags disclosure by many months or longer.
Class-Action Probe: Edelson Lechtzin LLP Investigates
The law firm Edelson Lechtzin LLP announced it is investigating potential class-action claims tied to the exposure of client tax records, according to a notice distributed via PR Newswire. An investigation announcement is a solicitation for potential plaintiffs and a signal of interest in litigation, not a filed lawsuit, a certified class, or a finding of liability against EY.
Data-breach class actions involving tax information and Social Security numbers tend to center on negligence claims: that the defendant failed to adequately secure sensitive data, failed to vet a third-party vendor, or delayed notification longer than state law allows. With EY’s own detection-to-disclosure gap running from an April 23 discovery to a July public surfacing, plaintiffs’ attorneys will likely scrutinize that roughly three-month window closely if litigation proceeds.
Third-Party Risk: Why Support Platforms Are the New Weak Link
Rescana’s analysis frames the EY incident as a textbook example of what it calls third-party concentration risk: a single operational system, in this case a vendor-managed ITSM platform never designed to be a records repository, ends up holding sensitive attachments simply because employees attach real documents to support tickets when troubleshooting issues. The platform was built for IT operations, not for storing tax returns and bank account numbers, yet that is effectively what it became.
This is not an isolated pattern in 2026. The same shape, a trusted vendor or shared platform becoming the entry point into an otherwise well-defended organization, has shown up repeatedly across the year’s breach disclosures, from the Snowflake-linked exposure that rippled across roughly 165 companies to a broader surge in ransomware groups prioritizing data theft over encryption that tech-insider.org has reported climbed 275 percent year over year. Big Four accounting firms are especially attractive targets because of the sheer breadth of sensitive client data that flows through their internal tooling, often touching dozens of major corporate clients at once.
Competitive Comparison: How EY’s Response Stacks Up
Measured against other major 2026 vendor-side breaches, EY’s disclosure timeline sits in a familiar range, neither unusually fast nor unusually slow. The company that disclosed an ASOS-linked hack threat saw its shares drop 13 percent after a 14-day leak deadline was publicized, a reminder that market reaction tends to track the drama of the threat actor’s public messaging as much as the underlying technical severity. EY, as part of the privately held Ernst & Young Global Limited network rather than a separately traded U.S. company, has no comparable public stock signal to measure, which may partly explain why this story has moved more through specialist cybersecurity outlets than financial media.
| Incident | Entry Point | Disclosure-to-Public Gap | Named Victims Confirmed |
|---|---|---|---|
| EY (2026) | Third-party ITSM/support-ticket platform | ~3 months (detection to public disclosure) | Goldman Sachs, Man Group-linked individuals |
| ASOS-linked hack threat (2026) | Alleged Snowflake-linked exposure | Days (threat-driven) | Not individually named per published reports |
| Snowflake customer exposure wave (2026) | Compromised customer credentials/platform | Varied by affected company | Approximately 165 companies implicated |
The common thread across all three is that the breached organization’s own perimeter was not the point of failure. That is pushing cyber insurers to rethink how they price risk tied to vendor dependencies. Cyber insurance carriers have been adjusting policy terms around third-party and supply-chain exposure as these incidents accumulate, since a single compromised vendor can trigger claims across dozens of downstream clients simultaneously.
Historical Context: A Pattern Big Four Firms Can’t Ignore
Professional services firms sit on an unusual concentration of sensitive data: tax filings, merger documents, audit workpapers, and payroll records for a huge share of the corporate world. That makes them a standing target, and the EY incident is unlikely to be the last time a Big Four firm’s internal tooling, rather than its client-facing systems, turns out to be the point of entry. The lesson from this incident, and from the broader 2026 third-party breach wave Rescana and BlackFlag Advisory have both written about, is that operational software, ticketing systems, chat logs, internal wikis, often contains far more sensitive material than its original design intended, simply because employees use the tool that is in front of them to solve the problem at hand.
For comparison, EY’s July notification followed a now-familiar sequence also seen in other 2026 incidents: a multi-week unauthorized access window, a detection lag of several weeks, and a public disclosure gap stretching into months. The gap between detection and disclosure is where companies tend to draw the most criticism, since it is the period during which affected individuals have no idea their data may be exposed and cannot take protective steps like freezing credit or monitoring accounts.
What This Means for EY’s Institutional Clients
For Goldman Sachs, Man Group, and any other institutional names that surface as EY’s review continues, the immediate practical concern is narrower than it sounds. The exposure runs through documents EY generated or stored while doing tax-related work, not through a breach of either institution’s own systems. Still, affected individuals connected to those firms, whether employees, executives, or clients of the institutions themselves, now have to treat their Social Security numbers and financial account information as compromised and take the standard precautions: credit monitoring, fraud alerts, and close review of account statements for months to come.
There is also a trust dimension that goes beyond the technical exposure. Clients hire EY specifically because the firm is supposed to be a secure custodian of exactly the kind of information that just leaked. Every additional institutional name that surfaces in future notification rounds adds pressure on EY to explain not just what happened, but why a support-ticket platform was ever allowed to accumulate this much sensitive attachment data in the first place.
Predictions: Where the EY Breach Story Goes From Here
- Expect additional institutional client names to surface as EY’s review of affected documents continues and more notification letters go out.
- Additional state attorney general filings beyond California are likely as EY’s legal team completes its multistate notification obligations.
- The Edelson Lechtzin LLP investigation could evolve into a filed class-action complaint within the coming months if a critical mass of affected individuals comes forward.
- Pressure will grow on EY, and on Big Four peers watching this unfold, to publicly commit to auditing internal ITSM and support platforms for retained sensitive attachments.
- The identity of the compromised vendor may eventually surface through litigation discovery even if EY never names it voluntarily in a public notice.
Related
- EY Vendor Breach: Tax Data Exposed, 81-Day Silence [2026]
- Who Is ShinyHunters? 7.1M Records, 3 Arrests [2026]
- Snowflake Denies ASOS Breach as 165-Firm Echo Grows [2026]
- Asos Data Breach: Shares Drop 13% After Hack Threat [2026]
- Coalition vs Chubb vs At-Bay: $575M Cyber Insurance [2026]
Frequently Asked Questions
What happened in the EY data breach?
An unauthorized party accessed a third-party IT service management platform that EY’s IT staff used to support tax teams, downloading client-related documents between late March and April 12, 2026. EY detected the activity on April 23, 2026, and disclosed it publicly in July 2026, according to Rescana and Cybersecurity News.
Were Goldman Sachs and Man Group hacked?
No. The breach occurred on EY’s side, specifically on a vendor-managed support platform EY used internally. Letters sent in late September 2026 confirmed that individuals connected to Goldman Sachs and Man Group were among those whose information was included in the exposed documents, per Cybersecurity News, but neither institution’s own systems were reported as compromised.
Who is behind the EY data breach?
The extortion group ShinyHunters publicly claimed responsibility in late July 2026, according to the Datapath newsletter. EY’s own notification did not name a threat actor, and no outlet reviewed reports independent confirmation of that claim.
What data was exposed in the EY breach?
Reported categories include names, home addresses, Social Security numbers, bank account numbers, credit and debit card numbers, tax filing information, and documents related to investment holdings and institutional client relationships. The exact data elements varied by document and individual, and no confirmed total record count has been published.
Has EY identified the compromised vendor platform?
No. EY’s public notification describes the compromised system only as a third-party IT service management or support-ticket platform. The specific vendor has not been publicly named by EY or confirmed by any outlet reviewed.
Is there a lawsuit against EY over the data breach?
The law firm Edelson Lechtzin LLP announced it is investigating potential class-action claims related to the exposure of client tax records, per a PR Newswire release. As of the latest reporting, this is an investigation and solicitation for potential claimants, not a filed lawsuit or certified class action.
Did EY face any regulatory penalties over the breach?
EY filed a breach notification with the California Attorney General’s office on July 15, 2026. No fine, enforcement order, or confirmed regulatory penalty has been reported against EY in connection with this incident as of the latest available coverage.
How does the EY breach compare to other 2026 third-party breaches?
It follows a pattern seen across 2026: a compromised vendor or shared platform, rather than the primary company’s own perimeter, serves as the entry point, and detection lags the actual intrusion by weeks. Similar dynamics played out in the Snowflake-linked exposure that touched roughly 165 companies and in the ASOS hack-threat disclosure, though the specific numbers, timelines, and data types differ across each incident.
Related Coverage
- DTU Breach Exposes Data of 200,000 Users [2026]
- Asos Data Breach: Shares Drop 13% After Hack Threat [2026]
- Hyundai Capital Hack Exposes Data of 146 Loan Agents [2026]
- EY Breach Reveals 85-Day Vendor Risk Gap [2026]
- Snowflake Denies ASOS Breach as 165-Firm Echo Grows [2026]
