Recent reporting by the Financial Times, Bloomberg, and The Economic Times has linked records affected by Ernst & Young LLP’s 2026 data breach to clients or investors connected with Goldman Sachs, Man Group, and Tishman Speyer.
In a sample notice dated July 13, 2026 and filed with the California Attorney General, EY said support tickets submitted through a third-party IT service management platform may have included documents containing client tax information. EY technology staff used the platform to support tax-related client work.
EY said it identified anomalous activity on April 23, 2026. Its investigation found that, between March 28 and April 12, 2026, an unauthorized third party accessed the platform and downloaded documents pertaining to a number of EY clients.
The notice said the involved information included certain personal information, with the specific fields varying by individual, and certain financial information contained in or used to prepare tax filings. EY said it secured its systems, worked with an independent cybersecurity firm, notified federal law enforcement, and was not aware at the time of misuse or further exposure of the information.
EY also offered affected recipients 24 months of Experian IdentityWorks credit and identity monitoring, with enrollment available through October 31, 2026.
Why this breach reaches beyond EY
The incident has not been described as a compromise of Goldman Sachs or Man Group systems. Bloomberg reported that a Goldman Sachs spokesperson said the bank’s systems were not affected and client assets remained safe.
That distinction is meaningful, but it does not remove the data-risk issue. Client information can be exposed through a professional services provider even when the original financial institution’s own network is not breached.
Major client names surfaced later
The California breach entry did not identify EY clients by name. The Financial Times later reported that clients of Goldman Sachs’ wealth management division and the UK-listed hedge fund Man Group were among those affected. The Economic Times also reported that sensitive client information linked to Goldman Sachs and Man Group was exposed.
The Economic Times reported that EY said the incident did not affect broader EY enterprise systems and presented no threat to ongoing business. It also reported that EY had been communicating review results directly to clients as its analysis concluded.
Massachusetts breach materials show how affected-client details can emerge in stages. A Tishman Speyer notice said EY completed its review and notified Tishman Speyer on August 25, 2026 that an individual’s information was impacted. A Man Group notice dated September 24, 2026 said EY had received personal information relating to investment holdings with Man Group and applicable affiliates while providing tax services.
What information was at risk
EY’s general California template used placeholders for individualized data elements, so the full mix of exposed fields was not visible in that public sample. The Vermont Attorney General’s security breach list for July 16 identified 13 affected Vermont residents and listed Social Security numbers, financial account codes, and credit/debit account information as involved categories.
Massachusetts’ 2026 breach report listed 480 affected Massachusetts residents in a July 15 EY filing and marked Social Security numbers as breached for that entry. Public filings cited by California, Vermont, and Massachusetts sources do not establish a total worldwide affected-person count.
Why secondary systems matter in vendor risk
The EY breach shows a risk many vendor reviews underweight: sensitive data does not only live in the systems built to store it. It can also appear in support tickets, screenshots, diagnostic exports, spreadsheets, log bundles, and email attachments. Support systems often sit outside the main recordkeeping environment that security, legal, and finance teams expect to monitor most closely.
For organizations that rely on accountants, law firms, managed service providers, payroll companies, financial advisers, or SaaS support teams, the relevant question is not only whether a supplier protects its primary application. It is whether sensitive files can be copied into secondary workflows, who can retrieve them, how long attachments remain, and whether bulk downloads trigger alerts.
The same issue applies internally. A company may have strong controls around its finance platform while leaving support tickets, shared drives, or troubleshooting exports with weaker retention rules and broader access.
What affected individuals can do now
Anyone receiving an EY notice should follow the instructions in the letter itself, because exposed fields vary and activation codes are individualized.
Tax and financial data can support phishing, account takeover attempts, and identity-fraud schemes. Affected recipients should be cautious with breach-related emails, phone calls, and text messages. Official enrollment processes should not require sharing passwords, one-time passcodes, or bank credentials with callers.
The unresolved questions
EY’s public template does not name the platform provider, the vulnerability, the total number of affected people, or every client whose records were in the downloaded documents. Reports have connected the wider incident to Checkmarx-related software, but the California notice itself does not name Checkmarx or describe the exploit path.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
