Ernst & Young has begun notifying clients of a data breach after an attacker compromised a third-party support platform and downloaded documents containing personal and financial information used in preparing tax returns.

The incident affected an external IT service-management system used by EY employees supporting the firm’s client tax services. Support tickets created through the platform could include document attachments, creating a route through which confidential tax records and related financial information were exposed.

EY detected suspicious activity involving the platform on April 23, 2026, and launched an investigation with assistance from an independent cybersecurity firm. The investigation determined that an unauthorised third party had accessed the system between March 28 and April 12 and downloaded documents belonging to multiple clients. More here