A cybersecurity incident affecting Ernst & Young (EY) has prompted a legal investigation after sensitive client tax records were exposed through a compromised third-party IT support platform. National class action law firm Edelson Lechtzin LLP is investigating potential claims on behalf of affected individuals as questions grow around third-party cybersecurity, enterprise data governance, and the protection of highly sensitive financial information.

One of the world’s largest professional services firms is facing renewed cybersecurity scrutiny after disclosing a data breach that exposed documents containing client tax information through a third-party IT service management platform.

Ernst & Young (EY) began notifying affected clients in July 2026 after discovering that an unauthorized third party had accessed a third-party support ticketing system used by its IT personnel supporting tax services. According to the firm’s disclosure, the attackers downloaded documents that may have contained personal and financial information used to prepare client tax filings.

The incident has now prompted an investigation by Edelson Lechtzin LLP, which is evaluating whether affected individuals may have legal claims stemming from the breach. The investigation focuses on whether appropriate cybersecurity safeguards were in place to protect sensitive taxpayer information and whether applicable data protection obligations were met.

According to EY, suspicious activity was first detected on April 23, 2026, triggering an internal investigation supported by external cybersecurity specialists. The forensic review concluded that unauthorized access occurred between March 28 and April 12, during which attackers accessed a third-party IT service management environment used by employees supporting tax-related client engagements.

While EY has confirmed that affected files were downloaded, the company has not publicly disclosed the total number of impacted clients, identified the third-party vendor involved, or clarified whether the breach extends beyond its U.S. operations. The company stated it secured the affected systems, terminated unauthorized access, and notified federal law enforcement following the discovery.

Unlike traditional ransomware attacks that focus on encrypting enterprise systems, this incident appears to center on unauthorized data access through a third-party workflow platform. Cybersecurity experts increasingly view these service management systems as attractive targets because they often contain support tickets, uploaded documents, internal communications, and customer records that provide attackers with valuable personal and financial information.

The potentially exposed information includes documents submitted to prepare tax filings, which can contain names, addresses, Social Security numbers, income records, financial account details, and other personally identifiable information (PII). Because tax documentation combines both identity and financial data, cybersecurity professionals consider it among the most sensitive categories of information an organization can hold.

At present, no ransomware or data extortion group has publicly claimed responsibility for the attack, and EY has stated it is unaware of any confirmed misuse of the compromised information. The company also indicated there is no evidence that specific individuals were intentionally targeted. Nevertheless, security analysts note that stolen tax information can remain valuable to cybercriminals long after an incident due to its usefulness in identity theft, tax refund fraud, financial account takeover, and highly targeted phishing campaigns.

The breach also renews attention on third-party cybersecurity risk, which has become one of the fastest-growing enterprise security challenges. Large organizations increasingly depend on cloud-based service providers, software vendors, and managed IT platforms that expand operational efficiency while also increasing the number of potential attack surfaces.

According to IBM’s Cost of a Data Breach Report, third-party involvement remains a significant contributor to enterprise security incidents, with supply chain attacks often increasing investigation complexity and remediation costs. Meanwhile, Gartner continues to identify third-party cyber risk management as a strategic priority as organizations expand digital ecosystems across cloud services and outsourced technology providers.

The incident follows an unrelated October 2025 report involving a publicly accessible SQL Server backup associated with an EY-acquired Italian entity. EY previously stated that event did not expose client information or confidential corporate data, distinguishing it from the current cybersecurity incident involving client tax documentation.

For affected clients, cybersecurity professionals generally recommend monitoring financial accounts, reviewing tax filings for suspicious activity, checking credit reports, enabling fraud alerts where appropriate, and obtaining an IRS Identity Protection PIN to reduce the risk of fraudulent tax return filings. Individuals who received breach notifications should also retain all communications related to the incident and consider enrolling in any complimentary identity monitoring services offered.

The EY incident illustrates how cybersecurity governance is increasingly extending beyond corporate networks to include vendors, cloud infrastructure, and enterprise collaboration platforms. As organizations continue modernizing digital operations, protecting sensitive financial information throughout complex technology ecosystems is becoming a critical component of enterprise risk management.

Market Landscape

Cybersecurity threats are increasingly targeting third-party software platforms that support enterprise operations rather than core production systems alone. IT service management platforms, cloud collaboration tools, and outsourced technology providers have become attractive entry points for attackers seeking access to sensitive customer data.

Global enterprises are responding by strengthening zero-trust architectures, continuous security monitoring, vendor risk assessments, identity governance, and AI-powered threat detection. Technology providers such as Microsoft, Google Cloud, Amazon Web Services, and Adobe continue expanding cloud security capabilities as organizations seek to reduce third-party cyber risk across increasingly interconnected digital ecosystems.

Strategic Outlook

The EY breach reinforces the growing importance of third-party cybersecurity governance in enterprise risk management. As organizations expand cloud adoption and digital collaboration, securing vendor platforms is becoming just as critical as protecting internal infrastructure.

The incident is likely to accelerate investment in vendor risk management, privileged access controls, AI-assisted threat detection, and continuous monitoring while increasing regulatory expectations around supply chain cybersecurity and customer data protection.

Top Insights

• EY disclosed unauthorized access to a third-party IT support platform that contained documents associated with client tax preparation, highlighting expanding third-party cybersecurity risks.
• The investigation will examine whether sufficient cybersecurity controls protected highly sensitive financial and identity information stored within enterprise support systems.
• Tax records represent one of the most valuable data types for cybercriminals because they combine financial information with personally identifiable information.
• Third-party software platforms are becoming increasingly common attack vectors as enterprises expand cloud-based digital operations and outsourced technology services.
• The incident underscores the growing importance of vendor risk management, identity security, and enterprise governance across complex digital ecosystems.

Get in touch with our Adtech experts