Ernst & Young’s data breach just got bigger, and it now has names attached to the victims. Letters sent to affected individuals in late September 2026 confirmed that people linked to Goldman Sachs and Man Group were among those whose information was taken when an unauthorized party broke into a third-party IT support platform used by EY’s tax teams, according to Cybersecurity News. The Financial Times followed in October 2026 with its own reporting that confirmed Man Group’s exposure and added a third institutional name, Tishman Speyer, while reiterating that the exposed Goldman Sachs data specifically touched the bank’s wealth-management client records. Goldman said its own systems were not breached and that client assets remained safe, but the growing list of marquee names shows how far a single vendor-side intrusion can travel. The disclosure marks a significant escalation from EY’s original July notice, which described the incident only in general terms as affecting “a number of EY clients.”
EY first disclosed the breach in July 2026, and tech-insider.org covered that initial filing when it surfaced. What’s changed since then is the scope: a named threat actor has stepped forward to claim credit, a law firm has opened a class-action investigation, and three marquee financial institutions are now tied to the exposed records. For a firm whose entire business rests on being trusted with other companies’ most sensitive financial data, the expanding fallout is a reputational problem as much as a technical one.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
How the EY Data Breach Unfolded: A Timeline
The mechanics of the EY data breach are now reasonably well documented across multiple outlets, even though some details, including the identity of the compromised platform vendor, remain unconfirmed. According to Rescana’s incident analysis, an unauthorized party accessed a third-party information technology service management platform, commonly called an ITSM or support-ticket system, that EY’s internal IT staff used to support teams handling client tax work. Cybersecurity News has since reported that the intrusion traced back to a vulnerability in Checkmarx software exploited in March 2026, giving the earlier accounts of the breach’s entry point a specific technical root cause.
The access window ran from March 28 through April 12, 2026, though CFO.com’s reporting cites a slightly earlier start date of March 26 based on EY’s own notice. During that 15-day window, which Accounting Times reported EY described to clients in July 2026, the intruder downloaded documents spanning six categories of client data: names, home addresses, tax-identification numbers, email addresses, financial information, and related tax-document records. EY did not detect the activity until April 23, 2026, 11 days after the access window closed and nearly four weeks after it began. EY then brought in an outside cybersecurity firm to investigate, a step confirmed by Security Affairs.
| Date | Event | Source |
|---|---|---|
| March 26–28, 2026 | Unauthorized access to the ITSM platform begins | Rescana, CFO.com |
| April 12, 2026 | Unauthorized access window ends; six categories of client data already downloaded | Rescana |
| April 23, 2026 | EY detects anomalous activity on the platform | Cybersecurity News |
| July 13, 2026 | Date listed on EY’s client notification letter | Cybersecurity News |
| July 15, 2026 | EY files breach notification with the California Attorney General | Cybersecurity News |
| July 17, 2026 | Breach becomes public via multiple outlets | Cybernews, Security Affairs |
| Late July 2026 | ShinyHunters publicly claims responsibility for the intrusion | Datapath newsletter |
| Late September 2026 | New letters confirm Goldman Sachs and Man Group client exposure; Financial Times reporting adds Tishman Speyer | Cybersecurity News, Financial Times |
Goldman Sachs, Man Group, and Tishman Speyer Clients Named in Expanded Notice
The September letters represent the first time EY has tied specific institutional names to the breach. Cybersecurity News reported that the new round of notifications described individuals connected to Goldman Sachs and Man Group as among those whose personal and financial information was exposed. The Financial Times subsequently reported a third name, Tishman Speyer, the commercial real estate investment firm, and added more specific detail on the Goldman Sachs exposure: the data taken related to Goldman’s wealth-management client records rather than the bank’s broader institutional operations. All three firms are major players in their markets, investment banking and asset management for Goldman Sachs and Man Group, commercial real estate for Tishman Speyer, and their inclusion suggests the platform held documents tied to high-value client relationships, not routine tax filings.
None of the three institutions has been reported as having had its own systems breached. Goldman Sachs went further than a simple denial: the bank stated that client assets remained safe throughout and that the exposure was confined to data held on EY’s compromised platform rather than any intrusion into Goldman’s own infrastructure, according to the Financial Times. The exposure appears to run through EY’s own infrastructure and the documents its tax practice generated while serving clients connected to those institutions. That distinction matters: this is not a Goldman Sachs breach, a Man Group breach, or a Tishman Speyer breach, it is an EY breach that happened to touch data associated with people who do business with those firms. It is the kind of indirect, vendor-side exposure that has become a defining feature of 2026’s breach landscape, similar in shape to the pattern seen when Snowflake customer-data exposure rippled across roughly 165 companies earlier this year.
| Institution | Business Type | Own Systems Breached? | Data Exposed |
|---|---|---|---|
| Goldman Sachs | Investment banking and wealth management | No breach reported (client assets remained safe per Goldman) | Wealth-management client records |
| Man Group | Publicly traded hedge fund manager | No breach reported | Client-connected individual records |
| Tishman Speyer | Commercial real estate investment | No breach reported | Client-connected individual records |
What Data Was Actually Exposed
EY’s own 2026 statement to Cybersecurity News narrowed the confirmed exposure to five categories of data: names, addresses, tax-identification numbers, email addresses, and financial information, though earlier notification letters and reporting had also described related tax-document records as a distinct sixth element. For individual taxpayers, a tax-identification number is typically a Social Security number, since that is the identifier the IRS uses on most personal filings. Support tickets on the compromised platform reportedly held these elements as attachments, alongside documents tied to the institutional client relationships at Goldman Sachs, Man Group, and Tishman Speyer described above.
| Data Category | Reported Detail |
|---|---|
| Names | Confirmed in EY’s notification letters |
| Home addresses | Confirmed in EY’s notification letters |
| Tax-identification numbers | For individuals, typically a Social Security number |
| Email addresses | Confirmed in EY’s notification letters |
| Financial information | Described broadly in EY’s notice; account-level detail not itemized publicly |
| Related tax-document records | Tied to tax filings and institutional client relationships |
It is worth stressing what the reporting does not establish. None of the outlets reviewed have published a confirmed total count of affected individuals or records. EY’s own notification reportedly refers only to “a number of” clients, and the available sources do not establish that every one of the six data categories was present for every affected person. Anyone citing a specific victim count for this incident is going beyond what has actually been confirmed.
ShinyHunters Enters the Picture
According to the Datapath newsletter, the extortion group ShinyHunters publicly claimed responsibility for the EY intrusion in late July 2026, weeks after EY had already filed its breach notification. ShinyHunters has been one of the most active extortion brands of the year, and tech-insider.org has tracked the group’s broader run of claimed breaches across multiple sectors. The group has also surfaced in connection with separate incidents, including a claimed hit against FBI-linked job portal infrastructure.
A public claim of responsibility is not the same as independent attribution. EY’s own notification, per Rescana and Security Affairs, did not name a threat actor, and none of the sources reviewed describe EY or an independent forensics firm confirming ShinyHunters as the responsible party. What can be said is that a group with a well-documented pattern of targeting SaaS platforms and support systems has stated publicly that it was behind this specific intrusion, and that claim has not been publicly disputed by EY.
EY’s Response: What the Firm Has Said
EY’s public posture has been narrow and procedural. Per Rescana’s analysis and Security Affairs’ reporting, the firm’s notification describes using a third-party ITSM platform to support IT personnel working with tax teams, confirms the access window, states that documents tied to a number of clients were downloaded, and confirms that EY engaged an independent cybersecurity firm and contained the activity. The notification does not name the vendor whose platform was compromised, and no outlet reviewed has independently identified that vendor either.
That silence on vendor identity is becoming a pattern worth watching across 2026’s breach disclosures generally. When the compromised system belongs to a supplier rather than the primary company, the affected firm often has limited ability, or limited incentive, to name that supplier publicly while contracts and liability questions are still being sorted out. It leaves regulators, class-action attorneys, and affected individuals without a clear picture of where the actual control failure occurred.
Regulatory Fallout: California AG Filing and What Comes Next
EY’s July 15, 2026 filing with the California Attorney General’s office is the first confirmed regulatory touchpoint, per Cybersecurity News. California’s breach notification law requires companies to report incidents affecting residents above a certain threshold, and the filing is what first made the basic shape of the breach public. Later reporting said notifications also involved regulators in Texas, Massachusetts, and Vermont, which fits the multistate notification that is common in incidents of this scale, and further filings would not be surprising as EY’s review of affected individuals continues.
No sources reviewed report a fine, a settled enforcement action, or a confirmed regulatory penalty against EY tied to this incident. That is consistent with the normal timeline for breach-related regulatory action, which typically lags disclosure by many months or longer.
Who Was Notified and What Each Institution Has Said
In September 2026, affected individuals connected with Man Group were notified by EY. Man Group said the incident involved third-party software used by EY and that Man Group’s own systems were not compromised. The available reporting does not establish that Man Group itself suffered a cyberattack, lost client assets, or experienced an operational outage. That matches the way the incident should be described for every named institution: as exposure through EY’s platform, not as a network breach at the client.
The same caution applies to Goldman Sachs. The available reporting describes exposure through EY’s platform rather than a confirmed intrusion into Goldman Sachs systems, and it says client assets remained safe. Reported categories of exposed data include names, postal addresses, email addresses, tax-identification information, and financial information, but the exact fields varied by person and client. Readers should therefore avoid treating any single list of fields as universal for every letter recipient.
For anyone who receives a notice, the practical step is to read which fields the letter lists for that person and to act on those, for example by freezing credit or watching accounts if a tax-identification number appears. The breach occurred on EY’s third-party platform, not necessarily in a client company’s own systems, so questions about what was held should go to EY, since the institution named in a letter is not the party that ran the compromised platform.
Class-Action Probe: Edelson Lechtzin LLP Investigates
The law firm Edelson Lechtzin LLP announced it is investigating potential class-action claims tied to the exposure of client tax records, according to a notice distributed via PR Newswire. An investigation announcement is a solicitation for potential plaintiffs and a signal of interest in litigation, not a filed lawsuit, a certified class, or a finding of liability against EY. A separate Edelson Lechtzin press release concerning Man Group was reportedly retracted after it misidentified the affected entity, with the clarification saying the breach affected EY, not Man Group or an affiliated entity.
Data-breach class actions involving tax filings and tax-identification numbers tend to center on negligence claims: that the defendant failed to adequately secure sensitive data, failed to vet a third-party vendor, or delayed notification longer than state law allows. With EY’s own detection-to-disclosure gap running from an April 23 discovery to a July public surfacing, plaintiffs’ attorneys will likely scrutinize that roughly three-month window closely if litigation proceeds. The expanding roster of named institutions also gives Edelson Lechtzin a larger pool of potentially affected individuals to draw on as its investigation continues.
Third-Party Risk: Why Support Platforms Are the New Weak Link
Rescana’s analysis frames the EY incident as a textbook example of what it calls third-party concentration risk: a single operational system, in this case a vendor-managed ITSM platform never designed to be a records repository, ends up holding sensitive attachments simply because employees attach real documents to support tickets when troubleshooting issues. The platform was built for IT operations, not for storing tax filings and financial records, yet that is effectively what it became.
This is not an isolated pattern in 2026. The same shape, a trusted vendor or shared platform becoming the entry point into an otherwise well-defended organization, has shown up repeatedly across the year’s breach disclosures, from the Snowflake-linked exposure that rippled across roughly 165 companies to a broader surge in ransomware groups prioritizing data theft over encryption that tech-insider.org has reported climbed 275 percent year over year. Big Four accounting firms are especially attractive targets because of the sheer breadth of sensitive client data that flows through their internal tooling, often touching dozens of major corporate clients at once.
Competitive Comparison: How EY’s Response Stacks Up
Measured against other major 2026 vendor-side breaches, EY’s disclosure timeline sits in a familiar range, neither unusually fast nor unusually slow. The company that disclosed an ASOS-linked hack threat saw its shares drop 13 percent after a 14-day leak deadline was publicized, a reminder that market reaction tends to track the drama of the threat actor’s public messaging as much as the underlying technical severity. EY, as part of the privately held Ernst & Young Global Limited network rather than a separately traded U.S. company, has no comparable public stock signal to measure, which may partly explain why this story has moved more through specialist cybersecurity outlets than financial media.
| Incident | Entry Point | Disclosure-to-Public Gap | Named Victims Confirmed |
|---|---|---|---|
| EY (2026) | Third-party ITSM/support-ticket platform | ~3 months (detection to public disclosure) | Goldman Sachs, Man Group, Tishman Speyer-linked individuals |
| ASOS-linked hack threat (2026) | Alleged Snowflake-linked exposure | Days (threat-driven) | Not individually named per published reports |
| Snowflake customer exposure wave (2026) | Compromised customer credentials/platform | Varied by affected company | Approximately 165 companies implicated |
The common thread across all three is that the breached organization’s own perimeter was not the point of failure. That is pushing cyber insurers to rethink how they price risk tied to vendor dependencies. Cyber insurance carriers have been adjusting policy terms around third-party and supply-chain exposure as these incidents accumulate, since a single compromised vendor can trigger claims across dozens of downstream clients simultaneously.
Historical Context: A Pattern Big Four Firms Can’t Ignore
Professional services firms sit on an unusual concentration of sensitive data: tax filings, merger documents, audit workpapers, and payroll records for a huge share of the corporate world. That makes them a standing target, and the EY incident is unlikely to be the last time a Big Four firm’s internal tooling, rather than its client-facing systems, turns out to be the point of entry. EY’s tax-platform breach was not even its only brush with exposed data in recent memory: in October 2025, researchers at Neo Security found a separate, publicly exposed EY-linked SQL backup containing 4 TB of data, including passwords, credentials, tokens, and API keys, according to SDxCentral. EY said that exposure was limited to an EY Italy acquisition and affected 0 client records. The lesson from both incidents, and from the broader 2026 third-party breach wave Rescana and BlackFlag Advisory have both written about, is that operational software, ticketing systems, chat logs, internal wikis, often contains far more sensitive material than its original design intended, simply because employees use the tool that is in front of them to solve the problem at hand.
For comparison, EY’s July notification followed a now-familiar sequence also seen in other 2026 incidents: a multi-week unauthorized access window, a detection lag of several weeks, and a public disclosure gap stretching into months. The gap between detection and disclosure is where companies tend to draw the most criticism, since it is the period during which affected individuals have no idea their data may be exposed and cannot take protective steps like freezing credit or monitoring accounts.
Why Wealth-Management Clients Keep Surfacing in the EY Breach
The three institutions named so far, Goldman Sachs, Man Group, and Tishman Speyer, share a common thread that helps explain why they turned up in an EY tax-platform breach at all: each serves a concentrated base of high-net-worth individuals and institutional investors whose tax affairs tend to be unusually complex. Goldman Sachs’ wealth-management division serves clients who typically hold investments across multiple entities, trusts, and jurisdictions, generating more support tickets and attachments than a routine individual filing would. Man Group, a publicly traded hedge fund manager, and Tishman Speyer, a major commercial real estate investment firm, fit a similar profile: both work with institutional and high-net-worth clients whose tax preparation often involves multi-entity structures and partnership returns.
That concentration cuts both ways for EY. The exposed data is likely more valuable to criminals, since records tied to complex, high-value financial relationships are more useful for fraud than a single routine filing. It also gives the named institutions outsized reputational leverage over EY, since asset managers and real estate investors depend on discretion as much as any other service they pay for. Goldman Sachs’ decision to state publicly that client assets remained safe, despite not being the breached party, reflects that pressure: the bank needed to reassure its wealth-management clients quickly, even though the control failure sat entirely on EY’s and its vendor’s side of the relationship.
As of October 2026, no additional institutional names beyond Goldman Sachs, Man Group, and Tishman Speyer have surfaced in the reporting reviewed, though EY’s own notification language, “a number of” affected clients, leaves room for more to emerge as the firm’s review continues. Regardless of how many more names appear, the control failure traces back to a support-ticket platform at EY, not to any weakness in how the named institutions secure their own systems.
What This Means for EY’s Institutional Clients
For Goldman Sachs, Man Group, Tishman Speyer, and any other institutional names that surface as EY’s review continues, the immediate practical concern is narrower than it sounds. The exposure runs through documents EY generated or stored while doing tax-related work, not through a breach of any institution’s own systems, and Goldman has publicly confirmed that client assets themselves were never at risk. Still, affected individuals connected to those firms, whether employees, executives, or clients of the institutions themselves, now have to treat their tax-identification numbers and financial information as compromised and take the standard precautions: credit monitoring, fraud alerts, and close review of account statements for months to come.
There is also a trust dimension that goes beyond the technical exposure. Clients hire EY specifically because the firm is supposed to be a secure custodian of exactly the kind of information that just leaked. Tishman Speyer’s emergence in the Financial Times’ reporting is the latest example of that pressure building, and every additional institutional name that surfaces in future notification rounds adds pressure on EY to explain not just what happened, but why a support-ticket platform was ever allowed to accumulate this much sensitive attachment data in the first place.
Predictions: Where the EY Breach Story Goes From Here
- Tishman Speyer’s emergence in Financial Times reporting confirms that more institutional client names were likely to surface, and additional names beyond Goldman Sachs, Man Group, and Tishman Speyer could still appear as EY’s review of affected documents continues and more notification letters go out.
- Further regulator notifications beyond California, Texas, Massachusetts, and Vermont are possible as EY’s legal team completes its multistate notification obligations.
- The Edelson Lechtzin LLP investigation could evolve into a filed class-action complaint within the coming months if a critical mass of affected individuals comes forward.
- Pressure will grow on EY, and on Big Four peers watching this unfold, to publicly commit to auditing internal ITSM and support platforms for retained sensitive attachments.
- The identity of the compromised vendor may eventually surface through litigation discovery even if EY never names it voluntarily in a public notice.
Frequently Asked Questions
What happened in the EY data breach?
An unauthorized party accessed a third-party IT service management platform that EY’s IT staff used to support tax teams, downloading six categories of client data, names, addresses, tax-identification numbers, email addresses, financial information, and related tax-document records, between March 28 and April 12, 2026. EY detected the activity on April 23, 2026, and disclosed it publicly in July 2026. Later notification rounds in September confirmed that individuals connected to Goldman Sachs and Man Group were affected, and the Financial Times subsequently added Tishman Speyer as a third named institution.
Were Goldman Sachs, Man Group, and Tishman Speyer hacked?
No. The breach occurred on EY’s side, specifically on a vendor-managed support platform EY used internally. Letters sent in late September 2026 confirmed that individuals connected to Goldman Sachs and Man Group were among those whose information was included in the exposed documents, and the Financial Times later added Tishman Speyer as a third affected institution. Goldman Sachs stated that its own systems were not breached and that client assets remained safe; the exposed Goldman data related specifically to its wealth-management clients. None of the three institutions has been reported as having had its own systems compromised.
Who is behind the EY data breach?
The extortion group ShinyHunters publicly claimed responsibility in late July 2026, according to the Datapath newsletter. EY’s own notification did not name a threat actor, and no outlet reviewed reports independent confirmation of that claim.
What data was exposed in the EY breach?
EY’s own 2026 statement narrowed the confirmed exposure to five categories of data: names, addresses, tax-identification numbers, email addresses, and financial information, though earlier letters and reporting had also listed related tax-document records as a sixth element. For individual taxpayers, the tax-identification number involved is typically a Social Security number. The exact combination of data elements varied by document and individual, and no confirmed total record count has been published.
Has EY identified the compromised vendor platform?
No. EY’s public notification describes the compromised system only as a third-party IT service management or support-ticket platform. The specific vendor has not been publicly named by EY or confirmed by any outlet reviewed.
Is there a lawsuit against EY over the data breach?
The law firm Edelson Lechtzin LLP announced it is investigating potential class-action claims related to the exposure of client tax records, per a PR Newswire release. As of the latest reporting, this is an investigation and solicitation for potential claimants, not a filed lawsuit or certified class action.
Did EY face any regulatory penalties over the breach?
EY filed a breach notification with the California Attorney General’s office on July 15, 2026. No fine, enforcement order, or confirmed regulatory penalty has been reported against EY in connection with this incident as of the latest available coverage.
How does the EY breach compare to other 2026 third-party breaches?
It follows a pattern seen across 2026: a compromised vendor or shared platform, rather than the primary company’s own perimeter, serves as the entry point, and detection lags the actual intrusion by weeks. Similar dynamics played out in the Snowflake-linked exposure that touched roughly 165 companies and in the ASOS hack-threat disclosure, though the specific numbers, timelines, and data types differ across each incident.
What did Goldman Sachs say about the breach?
Goldman Sachs said its own systems were not breached and that client assets remained safe throughout the incident. According to the Financial Times, the exposed data tied to Goldman related specifically to its wealth-management client records, which were held on EY’s compromised third-party platform rather than on any Goldman-controlled system.
Is Tishman Speyer part of the EY data breach?
Yes. The Financial Times reported that Tishman Speyer is a third institution, alongside Goldman Sachs and Man Group, whose client-connected individuals were named in EY’s expanded breach notifications. As with the other two firms, there is no report that Tishman Speyer’s own systems were compromised; the exposure is tied to documents held on EY’s third-party platform.
