EY 2026 Data Breach

Depending on the document, downloaded information could include a person's name, address, Social Security number, financial account number, and credit or debit card number. EY also reported that other personal and financial details used to prepare tax filings may have been involved. This entry lists only those classes supported by the company and regulatory notifications.

The company did not say that every client document contained every field. Passwords, biometric data, and medical records were not part of the described scope and are not added as data categories. The combination of a Social Security number, financial accounts, and tax information nevertheless creates serious exposure to identity theft, fraudulent tax returns, new-account fraud, and targeted financial scams.

The breach involved an external service-management platform used for tax-support requests rather than EY's main public website. Ticketing systems may collect screenshots, attachments, and detailed client context, which can make an ordinary-looking help request much more sensitive than expected. The incident shows why support attachments need data classification, retention controls, and access protection comparable to primary business systems.

EY did not disclose how the attacker first entered the platform, name a vulnerability, or identify a responsible threat actor. There is also no confirmed report that a known ransomware or extortion group claimed the event. This record does not speculate about the attack method and stays within the verified facts about platform access, the date range, and downloaded documents.

Tax documents can combine employer, income, account, and identity details in one place. An attacker could use them to file a fraudulent tax-refund claim, write highly convincing messages with authentic client information, or impersonate a tax adviser. If you receive an unexpected tax-agency notice, duplicate-return warning, or refund request that you do not recognize, dispute it promptly through the tax authority's official channel.

People whose card or bank-account number was affected should contact the financial institution using the known number for the card or account. Enable transaction alerts, examine even small test charges, and replace the card or account when the institution recommends it. Those whose Social Security number was involved should consider free freezes at all three credit bureaus and any additional identity-protection option offered for their tax account.

EY said it activated incident response, remediation, and recovery after identifying the anomalous activity and engaged an independent cybersecurity firm to investigate the nature and scope. As of the notification, the company said it was unaware of misuse or further exposure of the affected personal information. That statement does not mean there is no risk; it reports only that misuse had not been confirmed at that time.

Eligible affected people were offered two years of free credit monitoring, identity monitoring, and identity-restoration services. Recipients should enroll using the link and code in their own notice rather than entering a Social Security number on a page reached through a search advertisement or unexpected message. Monitoring does not replace regular review of existing accounts, statements, and tax records.

Someone holding downloaded support documents may impersonate an EY professional using a correct project, client, tax-period, or account detail. A message containing real information is not necessarily from the genuine sender. Verify requests to upload a new document, change banking details, enable remote access, or share a one-time code through a separate channel with a known EY contact instead of replying to the message.

Treat messages about “breach compensation,” “activate free monitoring,” or “resubmit your tax file” with particular caution. Do not enable macros in attachments and inspect the full domain character by character. Within a client organization, coordinate the review across tax, legal, finance, and security teams because a single stolen support attachment may contain secrets belonging to several departments.

Texas Attorney General record BR-0005180 publishes an exact nationwide total of 10,895 people and a Texas subset of 873. The Texas figure is included within the nationwide population and is not added again. Direct recipients should rely on the data types identified in their individual EY notice.

This record covers only the March 28–April 12, 2026 access to the third-party support platform and is separate from other EY cyber events. The Texas portal's April 23 end-date field is the date on which the company letter says anomalous activity was identified; it does not replace the detailed access window. Future platform, intrusion-method, or data-category details should be added only when verified.