Ernst & Young, one of the Big Four accounting firms trusted with the financial secrets of millions, just confirmed that attackers spent roughly two weeks rifling through a third-party system used for client tax services. The breach window ran from March 28 to April 12, 2026, but EY didn’t detect it until April 23. Clients didn’t start receiving notifications until July.

What happened and what was exposed

The breach targeted an external IT support platform that EY used to handle client tax filings. Attackers gained unauthorized access and downloaded documents that contained personal and financial information tied to tax records. The compromised data potentially includes Social Security numbers.

EY brought in an independent cybersecurity firm to investigate the incident after discovering the unauthorized access. The company says it has since shut down the attack vector and secured its systems.

EY’s core internal systems were not compromised, according to the firm’s own assessment. The vulnerability existed in a third-party vendor’s support ticket infrastructure, not in EY’s primary platforms.

The legal and regulatory fallout

EY has filed breach notifications with state attorneys general in California and Massachusetts, among other jurisdictions. Multiple law firms are already investigating potential class-action claims related to the breach.

EY handles tax services for an enormous number of corporate and individual clients globally. The firm is one of four accounting giants that collectively audit the majority of publicly traded companies worldwide.

Why crypto and fintech investors should pay attention

This breach didn’t involve any blockchain data, crypto tokens, or digital asset platforms. The EY breach is a case study in how third-party vendor relationships represent a systemic vulnerability, as the weakest link in a vendor chain becomes a firm’s biggest liability.

EY has been active in blockchain and digital asset advisory, demonstrating its engagement with emerging technologies. However, this incident emphasizes the ongoing challenges firms face with safeguarding client data as tax preparation processes become increasingly digitized and reliant on third-party technology.