EY Notifies Clients of Data Breach After Third-Party Platform Compromise Ernst & Young (EY) has begun notifying affected individuals following a data breach involving a third-party IT service management platform used by its tax practice. The incident exposed personal and financial information belonging to multiple tax clients, though EY reports no evidence of misuse to date. The breach was detected on April 23, 2026, after EY’s Information Security team identified anomalous activity on the platform. An investigation, supported by an independent cybersecurity firm, determined that unauthorized access occurred between March 28 and April 12, 2026, during which attackers downloaded client-related documents. The affected systems were secured, and federal law enforcement was notified. The compromised platform, used to manage support tickets for tax-related engagements, may have contained sensitive documents, including personal and financial details tied to tax filings. While the exact data exposed varies by individual, EY’s notification letters dated July 13, 2026 confirm that affected parties will receive specific details about their compromised information. As part of its response, EY is offering 24 months of complimentary Experian IdentityWorks credit monitoring and identity restoration services to impacted individuals, with enrollment required by October 31, 2026. The firm has not disclosed the number of affected clients, the identity of the third-party provider, or the threat actor responsible for the breach.