Ernst & Young is sending breach notifications to clients after confirming that an unauthorized party accessed an internal IT support platform and downloaded documents containing sensitive client tax information. The Big Four firm filed formal notice with the California Attorney General’s office on July 15, 2026, laying out a timeline that shows attackers had access for roughly two weeks before anyone noticed.

A Support Ticket System Becomes the Weak Point

According to EY’s notification letter, dated July 13, 2026, the firm relies on a third-party IT service management platform to help its technical staff support internal teams that handle tax-related client work. That kind of platform is standard in large enterprises — employees submit tickets describing technical problems, often attaching relevant files so support staff can diagnose the issue.

The trouble is that those attachments, in EY’s case, routinely included sensitive client tax data. It is a common workflow across the industry, since attaching a document is the fastest way to show a support technician exactly what is going wrong, but it also means a support ticketing system can end up holding a concentrated cache of confidential material that was never really designed to be a secure document repository in the first place.

Timeline of the Breach

EY says it detected anomalous activity on the platform on April 23, 2026, and immediately kicked off its incident response process, bringing in an independent cybersecurity firm to investigate. That investigation determined the actual unauthorized access had started well before detection — between March 28 and April 12, 2026 — meaning the intrusion and the response were separated by roughly three weeks.

That gap matters. A three-week head start gives an attacker substantial time to explore a system, identify the most valuable files, and exfiltrate them before defenders even know something is wrong. By the time EY’s team spotted the anomaly, the downloading of documents had already taken place.

What Was Exposed

The documents accessed and downloaded reportedly contained personal information connected to individuals’ investment holdings with EY’s institutional clients, alongside financial details used in preparing tax filings. That combination — investment account data paired with tax preparation records — is exactly the kind of information that can be valuable for identity theft or targeted financial fraud if it ends up in the wrong hands.

EY’s notification states that, as of now, the firm has no evidence the exposed data has been misused, nor any indication that specific individuals were deliberately singled out. That is a common early-stage assessment in breach notifications and does not rule out future misuse; it simply reflects what has been observed so far.

Not EY’s First Incident

This breach adds to a growing list of security lapses at the firm. It is separate from an earlier incident disclosed in October 2025, in which a roughly 4-terabyte SQL Server backup tied to EY’s Italian entity was found sitting publicly accessible on Azure cloud storage — the kind of misconfiguration that researchers frequently stumble across when scanning for exposed cloud assets.

EY also suffered a breach in 2023 connected to the mass-exploited MOVEit Transfer vulnerability, a supply-chain-style flaw that impacted more than 30,000 individuals tied to the firm at the time and hit hundreds of other organizations globally that relied on the same file transfer software.

Taken together, the pattern points to a recurring challenge for large professional services firms: they sit on enormous volumes of sensitive client financial data, and that data does not stay confined to the systems specifically designed to protect it — it spreads into cloud storage, support tickets, and other operational tools that may not receive the same level of security scrutiny as core client-facing platforms.

Why Support Platforms Are an Attractive Target

Security researchers have increasingly flagged IT service management and helpdesk tools as appealing targets precisely because they aggregate data from many different clients and business units into one place, often with less stringent access controls than the primary systems that data originally came from.

For a firm the size of EY, which processes tax and financial information for institutional clients around the world, a single compromised support system can cascade well beyond the firm itself — reaching the end customers of those institutional clients and multiplying both the regulatory exposure and reputational damage from a single point of failure.

EY has not detailed what remediation steps it is taking beyond the initial incident response, but affected clients should expect standard breach-notification guidance, including monitoring of financial accounts and awareness of phishing attempts that could try to leverage the exposed tax and investment details.