EY breach reveals tax data via third party ticket system

Ernst & Young (EY) announced a data breach involving a compromised third-party IT support ticket system, which contained client documents, including tax information. The breach was detected on April 23, 2026, and unauthorized access occurred between March 28 and April 12 of the same year. EY's information security team initiated an incident response and worked with external cybersecurity experts to investigate.

No evidence of misuse of the exposed data has been found, but affected clients are being offered 24 months of identity monitoring services. The total number of impacted clients is currently unclear.