Excerpt from Tech Insider, Published on October 7, 2026
Ernst & Young (EY) has expanded its disclosure of a 2026 data breach involving a third-party IT service management (ITSM) platform used by its internal IT teams supporting tax operations. According to reporting cited by Tech Insider, notification letters sent in late September confirmed that individuals connected to Goldman Sachs and Man Group were among those whose information was exposed.
The unauthorized access reportedly occurred between March 26–28 and April 12, 2026. EY detected anomalous activity on April 23 and subsequently engaged an independent cybersecurity firm to investigate the incident. EY’s July notification stated that documents associated with a number of clients had been downloaded. The specific vendor operating the compromised ITSM platform has not been publicly identified.
What Data Was Exposed?
The compromised support-ticket system reportedly contained attachments with sensitive personal, tax, and financial information. Reported data categories include:
| Data Category | Reported Information |
|---|---|
| Names and addresses | Included in affected documents |
| Social Security numbers | Reported in exposed documents |
| Bank account numbers | Present in financial documents |
| Credit and debit card numbers | Reported as exposed |
| Tax and financial information | Included in compromised support-ticket attachments |
| Investment and institutional documents | Associated with affected client relationships |
The available reporting does not establish a confirmed number of affected individuals or records. It also does not indicate that every listed data category was exposed for every affected individual.
Goldman Sachs and Man Group Were Not Directly Breached
The exposure does not appear to involve a compromise of Goldman Sachs or Man Group’s own systems. Instead, the information was reportedly exposed through EY’s infrastructure and documents created or handled as part of its client-related tax work. Individuals connected to the two financial institutions were identified in the expanded September notifications.
| Date | Event |
|---|---|
| March 26–28, 2026 | Unauthorized access to the third-party ITSM platform begins |
| April 12, 2026 | Reported unauthorized access period ends |
| April 23, 2026 | EY detects anomalous activity |
| July 15, 2026 | EY files breach notification with the California Attorney General |
| Late July 2026 | ShinyHunters publicly claims responsibility |
| Late September 2026 | Notifications identify Goldman Sachs and Man Group-linked individuals |
The extortion group ShinyHunters has publicly claimed responsibility for the intrusion. However, the available reporting does not establish independent confirmation of that attribution, and EY’s notification did not identify a threat actor.
Third-Party Risk and Sensitive Data
The incident highlights the risks of storing sensitive information within operational platforms that may not have been designed to function as repositories for tax, financial, or personal records. Support-ticket systems can accumulate confidential attachments when employees use them to troubleshoot technical issues.
For organizations, the EY data breach underscores the importance of third-party risk management, access controls, data minimization, monitoring, vulnerability management, and controls governing sensitive attachments. Organizations should also review whether operational platforms retain sensitive information longer than necessary and whether appropriate security controls are operating effectively.
The incident remains subject to further review. The exact number of affected individuals, the identity of the compromised vendor, and the full scope of exposed information have not been publicly established.
For additional information, visit Tech Insider.
