Ernst & Young Tells Clients Their Tax Data Was Taken From a Support Ticket System

Key points

• Ernst & Young detected suspicious activity on its network on April 23 and traced the intrusion to a third-party support ticket platform used by its IT staff.
• The unauthorised party accessed the system between March 28 and April 12 and downloaded multiple documents, some containing client tax information.
• EY is offering affected clients 24 months of identity monitoring and restoration through Experian, with an enrolment deadline of October 31, 2026.
• The firm hasn't said how many clients were affected or which countries are involved.
• No ransomware or extortion group has claimed responsibility.

Ernst & Young, one of the four largest auditing and advisory firms in the world, is writing to clients to say that some of their tax paperwork was taken by an outside party. The firm employs 406,000 people and reported global revenue of $53.2 billion last year.

The breach didn't hit EY's own core systems. It hit a third-party support ticket platform, a helpdesk tool where IT staff track and resolve requests. Support tickets on that platform sometimes had documents attached, and some of those documents contained client tax data.

According to the notification sample first reported by BleepingComputer, EY spotted "anomalous activity" on its network on April 23 and brought in outside cybersecurity specialists. The investigation concluded that an unauthorised party had access to the helpdesk platform between March 28 and April 12, and downloaded files during that window.

What was actually taken?

Certain personal and financial information used to prepare tax filings. The notification letter uses a placeholder where the specific data categories should appear, so the exact fields aren't spelled out in the sample. EY has also not disclosed how many clients received letters, or whether the incident is limited to United States clients.

The firm says it has secured its systems, removed the unauthorised access, and notified federal law enforcement. It adds that it has no evidence the stolen files have been misused or published, or that specific individuals were targeted.

Affected clients are being offered 24 months of identity monitoring and restoration services through Experian. Recipients need to enrol by October 31, 2026.

What should affected clients actually do?

Enrol in the Experian monitoring before the deadline, and treat any unexpected tax correspondence with suspicion. Tax data serves criminals in two practical ways: filing fraudulent returns in someone else's name to collect a refund, and building convincing scam approaches that reference real figures from a real filing.

If you receive a call or email claiming to be from a tax authority or from EY asking you to verify details, end the contact immediately and reach the organisation through a number you already trust. Watch bank and credit card statements. Consider a credit freeze if you're in a country that offers one.

No extortion or ransomware crew has posted EY data or claimed the attack. That doesn't mean the files will stay quiet. Stolen data often surfaces months later, bundled into other leaks or sold quietly.

This incident fits a pattern our piece on vendor risk and board accountability from 14 July examined directly: third-party tools sit inside the security perimeter of the companies that use them. A helpdesk platform that stores attachments is, in practice, a filing cabinet full of customer records. When that cabinet gets picked, the client whose data was inside pays the price.

EY hasn't publicly identified the support ticket vendor and hasn't answered questions about the number of clients affected or the geographic scope. Watch whether a headcount emerges as more notification letters reach clients outside the United States.

EY has not publicly identified the support ticket vendor, and has not answered questions about the number of clients affected or the geographic scope.