Ernst & Young Client Data Stolen in Third-Party Platform Breach

Key points

• Criminals stole names, home addresses, Social Security numbers, and credit and debit card numbers from an Ernst & Young-linked platform.
• The data was held by a third-party management platform the firm had contracted, not by Ernst & Young directly.
• Social Security numbers in the wrong hands can be used to open fraudulent loans or file false tax returns in a victim's name.
• SecurityWeek first reported details of the breach.

Ernst & Young, one of the world's largest accounting and professional-services firms, has confirmed that client personal and financial information was stolen after criminals broke into a third-party software platform, meaning a separate company's system that Ernst & Young had contracted to store or process data on its behalf.

The stolen records include names, home addresses, Social Security numbers (the unique nine-digit government IDs Americans use for taxes and banking) and credit and debit card numbers. That combination is serious: it gives criminals nearly everything they need to open new accounts or file fraudulent tax returns in a victim's name.

This is the second Ernst & Young breach we've reported since July. Our earlier story on 17 July 2026, "Ernst & Young Tells Clients Their Tax Data Was Taken From a Support Ticket System", covered a different third-party platform failure, one involving a helpdesk tool rather than a management platform. Two separate vendors, two separate incidents, within months of each other: that's a vendor-selection pattern worth watching.

What should affected people actually do?

Place a free credit freeze with all three major bureaus: Equifax, Experian and TransUnion. A freeze stops lenders from opening new accounts in your name, even with your Social Security number in hand. It costs nothing and you can lift it temporarily whenever you need credit yourself.

Also check bank and card statements for unrecognised charges, and watch your post for bills about accounts you never opened.

Should you worry about where exactly the data was kept?

Yes, and here's why it matters beyond this one firm. The data wasn't inside Ernst & Young's own network; it sat with an outside vendor handling certain management tasks. Third-party breaches follow a pattern CTI (cyber-threat intelligence) analysts track closely: large professional-services firms outsource to specialist vendors, those vendors often hold data for dozens of major clients at once, and one successful intrusion can expose records across many organisations simultaneously.

No specific hacking group has been publicly attributed to this incident, and no ransomware (malicious software that locks files until payment) has been linked to it. The method of intrusion hasn't been disclosed. Single-source attribution made early in a case like this is rarely reliable, and nothing here warrants confidence.

What the record shows is straightforward: real personal and financial data, belonging to real people, is now outside anyone's control.