Hackers Breach EY Third-Party IT Support Platform and Steal Client Tax Documents

Ernst & Young disclosed that an unauthorized third party infiltrated a vendor-managed IT service management platform and exfiltrated client tax documents and personal data (including possible Social Security numbers and financial account information) during March 28–April 12, 2026; EY detected the intrusion on April 23, contained the access, notified regulators and law enforcement, and is offering 24 months of credit/identity monitoring to affected individuals — the actor and motive remain unknown, underscoring third-party risk to professional services firms.