EY breach exposed tax data including Social Security numbers
Ernst and Young has confirmed that an unauthorised party broke into a third-party IT support ticketing platform used by its staff, and spent roughly two weeks downloading documents belonging to a number of EY clients before anyone noticed.
According to EY's breach notification filed with the California Attorney General on 15 July 2026, the intrusion ran from 28 March to 12 April 2026. EY says it identified anomalous activity on 23 April, more than a week after the access window closed, and immediately triggered its incident response process.
The documents contained personal information tied to individuals' investment holdings with EY's institutional clients, and financial information used to prepare tax filings. State filings say the exposed data may include Social Security numbers, financial account numbers and credit or debit card information. That is a combination identity thieves prize.
EY says it has no current evidence the data has been misused or that specific individuals were targeted. That is the standard line every breached company reaches for in the first notification letter. It describes what EY knows today, not what will be true in six months.
The firm is offering 24 months of free identity monitoring and restoration through Experian IdentityWorks, with an enrolment deadline of 31 October 2026.
What the notification does and does not say
Read the notification carefully and the shape of the incident is clear, even if the detail is thin. The entry point was not EY's own audit or tax systems as such. It was an IT support ticketing platform run by an outside supplier and used by EY staff.
Ticketing tools are dull, but they collect a lot. Staff attach screenshots, spreadsheets and PDFs to tickets so the help desk can see what is going wrong. Over months and years, a support queue can quietly become an archive of sensitive documents that nobody planned to keep.
EY has not, in the notification, said how many people are affected, and this piece does not guess. It also has not said how the attacker got in. Anyone treating this as a confirmed catastrophe or as a minor blip is running ahead of the facts. What is known is the categories of data involved, and those are serious enough on their own.
Why tax data is different
Most breaches leak an email address and a password. You change the password and move on. Tax records are a different class of problem, because they carry things you cannot change.
A Social Security number is issued once and stays with you for life. A date of birth does not change either. Put the two together with a home address and a financial account number, and a criminal can often open credit, file a false tax return or pass a weak identity check.
Tax-related identity fraud has a particular sting. Many victims only find out when their genuine return is rejected because someone has already filed in their name. Fixing it can take months of paperwork.
Stolen data also ages badly for the victim. Fraudsters often sit on records for a year or more, then use them in bulk. That is the real reason a "no evidence of misuse" statement offers limited comfort.
The supplier problem
This is not an isolated pattern. Large organisations can harden their own networks and still be exposed through a supplier holding a slice of their data.
We have seen the same shape elsewhere. Security firms got breached through a vendor they all trusted, and the ShinyHunters campaigns have repeatedly relied on a single weak link to reach many victims. The lesson is uncomfortable: your security is only as good as the least careful tool your staff use.
How exposure compares across data types
Not every piece of leaked data carries the same risk. This table gives a rough guide to what each category allows and what you can do about it.
| Data type | Main risk | Can you change it? | Best response |
|---|---|---|---|
| Social Security number | New credit, false tax returns | No | Credit freeze, monitoring |
| Date of birth | Identity verification bypass | No | Freeze, be wary of calls |
| Driver's licence number | Fake ID, account takeover | Yes, by reissue | Contact the licensing body |
| Card numbers | Unauthorised purchases | Yes, quickly | Ask the bank to reissue |
| Bank account details | Fraudulent debits | Partly | Alert the bank, watch statements |
| Email and phone | Phishing, SIM swaps | Partly | Treat unexpected contact as hostile |
The top two rows are the problem. Cards are the easiest thing to fix and the least damaging, because US federal rules generally cap a cardholder's liability for unauthorised card charges at $50, according to the Federal Trade Commission, and most issuers waive even that.
What to do if you're affected
If you've received or expect to receive a notification letter from EY, enrol in the Experian monitoring before the October deadline. Beyond that, consider placing a free credit freeze with Equifax, Experian and TransUnion directly through their websites, not through a paid third-party service. A freeze blocks new credit applications in your name until you lift it, and it costs nothing.
Watch for phishing emails that reference the breach itself. Scammers routinely send fake 'here is your free monitoring' links after news like this breaks, and the fastest way to get scammed twice is to click one.
Steps worth taking this week
- Enrol in the Experian service using the details in your letter, not a link in an email.
- Freeze your credit at all three bureaus. Each takes a few minutes online.
- Ask the US tax authority whether you can get an Identity Protection PIN, which stops anyone else filing with your number.
- Ask your bank to reissue any card that was part of your tax filings.
- Check your bank and card statements, and set up alerts for any transaction.
Steps for the longer term
Keep watching for a couple of years, not a couple of weeks. Free monitoring that lasts 24 months is useful, but a Social Security number is valid for far longer than that. Check your credit reports at least once a year, and look at every tax notice that arrives in the post.
Be careful about paid identity-protection services that push hard after a breach. Some charge a monthly fee for things you can do yourself for nothing. Credit freezes and fraud alerts cost nothing, and they do most of the heavy lifting.
If you have been caught up in other leaks, the risk compounds. Data from separate incidents gets combined. A single driver's licence leak in an earlier case was reported to involve a vast number of records, and fraudsters can match that against tax data to build a complete profile.
What this means for firms handling client data
For the businesses involved, the answer is not mysterious. Limit what staff can upload to support tools, set retention limits on old tickets, and check what a supplier actually stores before signing. Treat support platforms as holding regulated data, because in practice they do.
Clients of accountancy and advisory firms should also feel free to ask where their documents live, who can reach them, and how long they are kept. Few firms volunteer that information, but most have to answer when asked directly.
Key takeaways
- EY has confirmed an unauthorised party broke into a third-party IT support ticketing platform used by its staff, between 28 March and 12 April 2026.
- The data involved includes Social Security numbers, dates of birth, and card and financial account details, but EY says it has no current evidence of misuse or targeting.
- Tax and identity data cannot be reset like a password, so the risk can outlast the 24-month monitoring offer.
- Enrol in Experian monitoring before 31 October 2026, and freeze your credit for free at all three bureaus.
- Treat any email about the breach as suspect, and go to the official site or letter instead.
- Supplier tools such as help desks are a repeat weak point, and firms should limit what lands in them.
