TL;DR · 30-second read
The Short Version
Ernst & Young, one of the world’s best-known accounting firms, has told clients that hackers stole tax documents. The information included Social Security numbers, card numbers and home addresses.
The files came from a help-desk tool made by an outside company, which the firm uses to support its tax work. Documents could be attached to help requests there.
The lesson is simple: paperwork you hand to one trusted firm can end up in more places than you expect. Affected clients are being offered two years of free identity protection.
Ernst & Young (EY) has started notifying clients that their personal and financial information was compromised in a breach of a third-party service management platform used to support its tax work, SecurityWeek reported on July 20, 2026. EY discovered the incident on April 23 and says the attackers had access from March 28 to April 12, during which they downloaded client documents.
The documents contained names, addresses, Social Security numbers, account numbers, credit and debit card numbers, and other information used to prepare tax filings. EY says it is not aware of any misuse and is offering affected clients two years of free credit monitoring, identity monitoring and identity restoration services.
Executive Summary
EY’s notification describes a theft of client documents from an outside platform used for service management, the kind of software that tracks support requests. In a letter filed with the California Attorney General’s Office, the company wrote: “Support tickets submitted through the platform may include documents containing client tax information.”
That sentence is the most instructive part of the disclosure. Tax documents are among the most sensitive records a person hands to an adviser, and here they could also exist in a support workflow. A system that may be treated as routine administrative software can therefore hold data as sensitive as the tax work it supports.
For security and procurement teams, the case argues for assessing vendors by the data that actually reaches them, including attachments, and not only by the function the software was bought to perform. For individuals, it is a reminder that trusting one firm can also mean relying on the suppliers behind it.
The Ticket Queue Can Become a Document Store
Attackers had access to the platform for 16 calendar days, counting both March 28 and April 12, and EY says they downloaded client documents during that window. The mechanism EY describes is straightforward: tickets submitted through the platform may include documents containing client tax information. Once a file is attached, a copy can sit in a separate system with its own access rules, retention settings and vendor.
This is why support tickets deserve a line of their own in third-party risk reviews, the process organizations use to assess suppliers that touch their data. A ticketing tool may be classified by its purpose, which sounds low-risk, when its real exposure depends on what users upload. Free-form attachments are especially hard to govern because the sensitivity of the data is decided case by case by whoever opens the ticket, often while trying to solve an urgent problem.
Those affected are the clients whose documents were taken, but the lesson extends to any organization whose staff exchange sensitive files through help desks. Security leaders can test this directly by sampling old tickets, checking how long attachments are kept and confirming who can search them. EY has not said how the attack occurred, so this incident does not establish that ticket design caused the breach. It does show what a ticket archive can contain when a platform is compromised.
A Risk Chain With an Extra Link
Third-party risk usually describes the exposure a business takes on through its suppliers. Here, that chain has several links: a client gives records to EY, and EY uses an outside platform in supporting the related work. A client may have carefully assessed its adviser and still have limited visibility into the tools that adviser relies on.
That leaves clients of any large professional-services firm with practical questions to ask at engagement and renewal. Which outside platforms can receive their documents? Are attachments allowed in support channels, and how long are they kept? How quickly must the firm report an incident at one of its suppliers? Those questions apply well beyond accounting, since law firms, consultancies and outsourcers also handle sensitive client records through layers of software.
The same logic applies to buyers of hosted software more broadly. A vendor can run the service, but decisions about what data goes in, who can reach it and when it is deleted still shape the damage a breach can do. Limiting attachments and shortening retention are often within a customer’s control, and they reduce what is available to steal.
What the Dates Do and Do Not Show
The timeline is the most concrete evidence available. Access began March 28 and ended April 12, and EY discovered the incident on April 23 after identifying anomalous activity. That means discovery came 11 days after the stated end of access and 26 days after it began. By July 20, EY had started notifying clients, just under three months after discovery.
Those intervals raise fair questions without proving a failure. Determining exactly who was affected by a document theft can be slow, because investigators may need to review stolen files to learn whose data they contain. EY also says it activated incident response, began remediation and recovery, and engaged an independent cybersecurity firm. Even so, the 11-day gap highlights a point for every operator of outsourced systems: detection on a third-party platform depends on the logs and alerts available to the customer and the vendor.
Monitoring Helps, but Some Data Lasts
EY’s offer of two years of credit monitoring, identity monitoring and identity restoration is a concrete remedy, and its statement that it is not aware of misuse is meaningful as far as it goes. It describes what the company knows so far. It cannot guarantee how stolen data will be used in the future.
The types of data also carry different risk horizons. A payment card can be replaced, while a Social Security number and a home address are much harder to change. Monitoring can also alert someone to fraud without necessarily preventing it. That makes prevention upstream, including limiting how many systems hold these documents and for how long, an important part of reducing the risk.
Background
Ernst & Young, known as EY, is a global professional-services firm whose work includes tax services for clients. Firms in this line of business routinely handle detailed personal and financial records, which makes them and their suppliers valuable targets for data thieves.
Service management platforms are software tools organizations use to log, track and resolve support requests. Many are delivered by outside vendors, which is why they can fall within third-party risk programs. In the United States, breach notifications may also be filed with state authorities, as with the EY filings made with the California and Texas attorneys general. Source: Ernst & Young Data Breach Affects Personal, Financial Information, SecurityWeek’s report on EY’s client notifications about a breach of a third-party service management platform.Sources