Ernst & Young LLP (“EY”), one of the world’s largest professional services firms, has disclosed a data security incident that may have exposed personal information belonging to certain individuals. The incident involved unauthorized access to a third-party information technology service management platform used by EY personnel supporting tax-related client work.
According to EY’s notice, an unauthorized third party accessed the platform and downloaded documents containing client information. The company began notifying affected individuals on July 13, 2026, and is offering complimentary identity monitoring and restoration services through Experian IdentityWorks as a precaution.
Ernst & Young (EY) Data Breach Investigation
According to the data breach notification issued by EY, the company identified anomalous activity involving an information technology service management platform on April 23, 2026. The platform was used by EY information technology personnel to provide support to EY teams performing tax-related work for clients.
EY launched an investigation after discovering the suspicious activity and engaged cybersecurity professionals to determine the nature and scope of the incident, contain the issue, and begin remediation efforts.
Based on EY’s investigation and available evidence, an unauthorized third party accessed the platform between March 28, 2026, and April 12, 2026, and downloaded documents relating to certain EY clients.
The company stated that it is not aware of any misuse or further exposure of affected personal information. However, because sensitive personal and financial information may have been involved, EY is providing affected individuals with resources designed to help protect against possible identity theft and fraud.
EY stated that it took steps to secure its systems, launched an investigation with third-party specialists, notified federal law enforcement, and continues to monitor for additional information associated with the incident.
Cybersecurity incidents involving professional service providers can create significant concerns because firms such as EY often handle sensitive financial, tax, and personal information on behalf of clients. Unauthorized access to these systems may expose individuals to risks including identity theft, financial fraud, phishing attempts, and misuse of confidential information.
When Did This Breach Occur?
According to EY’s notice, an unauthorized third party accessed the affected technology platform between March 28, 2026, and April 12, 2026.
EY identified anomalous activity on April 23, 2026, and began investigating the incident with assistance from cybersecurity professionals.
The company issued notice to affected individuals on July 13, 2026.
What Information Was Breached?
According to EY’s notification, the information involved may include:
- Personal information identified in EY’s review of affected documents
- Financial information contained in or used to prepare tax filings
The specific data elements may vary depending on the individual. EY’s notice stated that affected information was connected to documents stored within the impacted platform and related to tax-related work performed for EY clients.
Because the incident may have involved tax-related information and personal identifiers, affected individuals should remain alert for potential identity theft, fraudulent tax activity, and targeted scams.
What You Can Do
If you received a notice regarding the EY data breach, consider taking the following steps:
- Enroll in identity protection services: EY is offering complimentary access to Experian IdentityWorks, including credit monitoring and identity restoration services for eligible individuals.
- Monitor credit reports: Review credit reports for unfamiliar accounts, inquiries, or suspicious activity.
- Monitor financial accounts: Check bank accounts, investment accounts, and other financial records for unusual transactions.
- Consider an IRS Identity Protection PIN: EY recommends that individuals who are eligible consider enrolling in the IRS IP PIN program to help protect against tax-related identity theft.
- Consider a fraud alert: A fraud alert can require creditors to take additional steps before opening new accounts.
- Consider a credit freeze: A credit freeze can help prevent unauthorized access to your credit file.
- Watch for phishing attempts: Be cautious of emails, calls, or messages referencing EY, tax filings, or personal information.
- Secure online accounts: Update passwords and enable multi-factor authentication where available.
- Save breach documents: Keep your EY notification letter and identity protection enrollment information.
- Document suspicious activity: Maintain records of unauthorized activity, expenses, or time spent responding to the incident.
EY has provided Experian IdentityWorks enrollment instructions, including an enrollment deadline of October 31, 2026.
Individuals with questions about the incident can contact EY at 833-931-7884 or email Privacy.Notification@ey.com.
File a Data Breach Lawsuit Against Ernst & Young (EY)
Companies that collect, process, and maintain sensitive personal information have a responsibility to implement reasonable cybersecurity safeguards to protect that information from unauthorized access. When a data breach occurs, affected individuals may face privacy concerns, identity theft risks, and costs associated with monitoring and protecting their personal information.
If your information was exposed in the Ernst & Young data breach, you may have legal options. A class action lawsuit may allow affected individuals to seek compensation for damages related to privacy violations, identity theft risks, financial losses, and expenses connected to responding to the breach.
By joining together with others affected by the same cybersecurity incident, individuals may be able to hold organizations accountable and encourage stronger protections for sensitive information.
Contact Class Action U to connect with experienced data breach lawyers. If you received a notice or believe your information may have been affected, fill out our secure form to learn more. There is no cost and no obligation to speak with a legal partner.
