Ernst & Young, one of the world’s largest auditing and professional services providers, has disclosed a data breach that occurred when an unauthorized third-party accessed its support ticket system. The breach is significant not only because of Ernst & Young’s size and reach but also because it highlights the potential vulnerabilities in even the most robust IT systems.
According to Ernst & Young, the breach occurred between March 28 and April 12, during which time an unknown party gained access to the company’s support ticket system. This system is used by its IT personnel to manage requests for assistance from clients, including those related to tax filings. As a result of the breach, certain personal and financial data may have been compromised.
Ernst & Young employs over 406,000 people in more than 150 countries and reported revenues of $53.2 billion last year. The company’s global reach means that it is likely that many individuals and organizations have been affected by the breach, although the exact number has not yet been disclosed. What is clear, however, is that the data compromised includes sensitive information related to tax filings.
The breach was discovered on April 23, when Ernst & Young detected anomalous activity on its networks. An investigation was subsequently launched in collaboration with external cybersecurity experts. The company’s response to the incident has been swift, with its systems secured and federal law enforcement authorities notified. However, there is no indication that any further exploitation of the stolen data has occurred.
Ernst & Young is offering affected clients 24 months of identity monitoring and restoration service through Experian as a precautionary measure. This is a sensible approach given the potential risks associated with sensitive data breaches. The company’s decision to notify its clients promptly is also commendable, demonstrating a commitment to transparency and accountability in the face of adversity.
As this incident highlights, even well-resourced organizations like Ernst & Young are not immune to cyber threats. In fact, the breach serves as a reminder that all companies, regardless of size or industry, must remain vigilant in their cybersecurity efforts. It is essential for businesses to regularly test their systems and processes to identify vulnerabilities before attackers do.
For individuals and organizations affected by this breach, it’s essential to be proactive in monitoring their credit and financial information. This can include registering with Experian’s identity monitoring service or taking other steps to protect themselves from potential identity theft. By being aware of the risks associated with data breaches like this one, we can all take steps to minimize our exposure and stay safe online.
Source: Bleeping Computer — 2026-07-17