EY notifies clients after third-party platform breach

Ernst & Young has notified clients after attackers accessed a third-party service management platform used to support tax-related work. The notification, filed with the California Attorney General's Office, states the platform may contain documents holding client tax information. Attackers had access between 28 March and 12 April 2026 and downloaded client documents containing names, addresses, Social Security numbers, account numbers, credit or debit card numbers and other information used in tax filings. EY detected anomalous activity on 23 April and engaged an external cybersecurity firm. The matter was reported by SecurityWeek.

What this means for you if your suppliers hold personal data

The breach did not happen at EY itself. It happened in a system EY had adopted. Berigo's assessment is that this is what most serious incidents look like in practice. The personal data you are the controller for sits with a supplier you chose, and onward with a supplier that supplier chose.

Note the timeline as well. The attackers had access for two weeks, and the activity was not discovered until three weeks later. In our view that is precisely the period you would need to reconstruct if you found yourself in a similar situation. It is also the period the data protection authority will ask you about.

Berigo recommends

• Map which suppliers actually store or process personal data on your behalf, and which sub-processors they in turn use.
• Require contractual breach notification deadlines that give you a real chance of meeting the GDPR 72-hour obligation.
• Ask critical suppliers for logging and retention details before you need them, not after something has happened.
• Keep a prepared template for notifying data subjects, so the wording is not written under time pressure.

Source

• securityweek.com
• oag.ca.gov