Ernst & Young

Disclosed Jul 14, 202610,895 affectedConfirmed

EY notifies clients of tax data theft from third-party support ticket system

Ernst & Young notified people that an unauthorized party downloaded documents from a third-party support ticket system used by its IT staff between March 28 and April 12, 2026, including personal and financial data used for tax filings. ShinyHunters later claimed the attack.

What is known

People affected	10,895 (as reported by the organization)
Disclosed	Jul 14, 2026
Discovered	Apr 23, 2026
Happened	Mar 28, 2026
Attack	Vendor breach
Data exposed	FinancialNamesSocial Security numbersOtherPayment cardsAddresses
Sector	Finance · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Ernst & Young

Regulatoroag.ca.gov

California AG breach notice: Ernst & Young

Newsbleepingcomputer.com

Ernst & Young discloses data breach after support system hack

Official noticeoag.my.site.com

Texas Attorney General data security breach report BR-0005180: Ernst & Young

Official noticeago.vermont.gov

Vermont Attorney General breach report: Ernst & Young

Official noticein.gov

Indiana Attorney General 2026 data breach report: Ernst & Young

Notices filed

Residents of INJul 14

Indiana AG28 people

Residents of CAJul 15

California AGCount not stated

Residents of VTJul 16

Vermont AG13 people

TotalJul 17

ResearchCount not stated

Residents of TXJul 17

Texas AG873 people

Other breaches at Ernst & Young

MOVEit breach at EY exposes Bank of America customer dataSupply chain exposed names, addresses, financial details, payment cards, Social Security numbers and government IDs. Reported to the California AG.Supply chain30K affectedTechUSJun 12, 2023

History of this record

disclosed2026-10-07

2026-07-15 to 2026-07-14by weeklySource

source2026-09-25

empty to https://ago.vermont.gov/categories/security-breach-noticesby backfillSource

data_types2026-09-25

["financial","names","ssn","other"] to ["financial","names","ssn","other","payment-card","addresses"]by backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 10895by backfillSource

sector2026-09-25

tech to financeby seedSource

attack2026-09-25

unknown to third-partyby seedSource

data_types2026-09-25

[] to ["financial","names","ssn","other"]by seedSource

discovered2026-09-25

empty to 2026-04-23by seedSource

summary2026-09-25

empty to Ernst & Young notified people that an unauthorized party downloaded documents from a third-party support ticket system used by its IT staff between March 28 and April 12, 2026, including personal and financial data used for tax filings. Shiby seedSource

title2026-09-25

empty to EY notifies clients of tax data theft from third-party support ticket systemby seedSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Ernst & Young