Ernst & Young Reports Breach Exposing Clients’ Personal and Financial Information
Summary
EY says attackers accessed a third-party tax-support platform from March 28 to April 12 and downloaded client documents containing personal and financial information. The company is offering affected clients two years of monitoring and identity restoration services.
Key points
- EY says it discovered the incident on April 23 after detecting anomalous activity on a third-party service management platform used for tax-related work.
- According to EY, attackers accessed the platform from March 28 to April 12 and downloaded client documents submitted through support tickets.
- The documents could contain names, addresses, Social Security numbers, account and payment-card numbers, and other tax-preparation information.
- EY activated incident response, began remediation and recovery, and engaged an independent cybersecurity firm to investigate.
- EY said it was unaware of misuse or further exposure and offered affected clients two years of credit monitoring, identity monitoring, and identity restoration services.
- EY has not disclosed how the attack occurred or identified the responsible threat actor.
Article Details
- Victim Organization
- Ernst & Young (EY)
- Incident Type
- Data breach involving unauthorized access to a third-party service management platform and download of client documents
- Data Types Exposed
- Names
- Addresses
- Social Security numbers
- Account numbers
- Credit/debit card numbers
- Other information used to prepare tax filings
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Hackers accessed the compromised platform between March 28 and April 12 and downloaded EY client documents. EY activated incident response and began remediation and recovery efforts. EY said it was not aware of misuse or further exposure and offered affected clients two years of credit monitoring, identity monitoring, and identity restoration services.
- Ransom Or Extortion
- No known ransomware or extortion group has claimed responsibility; no ransom or extortion activity was reported.
- Claim Status
- confirmed