Ernst & Young LLP, known as EY, has sent a notice of data breach to investors in Breakthrough Worldwide, L.L.C., telling them that personal information tied to their investment holdings was compromised. The notice was filed with the Massachusetts Office of Consumer Affairs and Business Regulation.
Because the information sat with a tax services firm rather than with the investment vehicle itself, many recipients may not recognize the sender. Here is what the notice discloses, and what it leaves out.
Breakthrough Worldwide’s Data Breach Investigation
The notice comes from EY, not from Breakthrough Worldwide. EY explains that it provides professional tax services to a wide range of financial institutions around the world, and that in the course of that work it received personal information about people who hold investments with Breakthrough. In other words, the people receiving this letter are investors whose details were passed to an outside tax adviser, and many of them never dealt with EY directly.
EY states that it determined individual investor personally identifiable information was compromised. It says the information involved varies from person to person, and that it may include a name, an address, financial information about the investment such as capital contribution and return figures, a Social Security number, tax identifiers, LP or investor codes, and partial taxpayer identification numbers. The company adds that bank account numbers, income, and net worth were not part of the affected data.
On its response, EY says that once it discovered the problem it took steps to secure its systems and began an investigation with outside specialists to determine the nature and scope of the event. It also says it informed federal law enforcement. To help affected people, EY is offering complimentary access to Experian IdentityWorks for 24 months, which includes credit monitoring and identity restoration support.
The Massachusetts filing is a sample copy of the letter, and it is not fully filled in. The line that lists the specific data elements for each recipient still shows a blank template field, and the enrollment deadline and activation details are also placeholders. The letter does not give the number of people affected, and it does not state dates for the incident. For that reason this page does not give a count for Breakthrough Worldwide.
Other notices that EY has filed for different fund clients describe what appears to be the same event. In those notices EY says that between March 28, 2026 and April 12, 2026, an unauthorized third party accessed a platform used by EY and downloaded documents pertaining to a number of EY clients, and that EY confirmed anomalous activity on April 23, 2026. The Breakthrough letter itself does not repeat those dates, so readers should treat them as context from the related filings rather than as a statement made specifically about Breakthrough investors.
The sample letter also refers to the investment vehicle as Breakthrough Services, L.L.C., while the Massachusetts filing is listed under Breakthrough Worldwide, L.L.C. We have used the name from the filing title. If you hold an investment connected to either name, the notice you received is the most reliable record of what applies to you.
Tax and investor records are valuable to criminals because they combine several identifiers in one place. A Social Security number or taxpayer identification number paired with a name, an address, and details of an investment is much more powerful than any one of those items alone. It can support tax refund fraud, new account fraud, and convincing impersonation of an investor to a bank or broker.
Professional services firms that hold large volumes of client tax documents have become a frequent target of attackers for exactly this reason. The data flows through many hands, including administrators, advisers, and software platforms, and the people the data describes have little visibility into any of them. When a breach happens at one of those intermediaries, the people harmed are often those furthest from the company that was attacked.
Anyone who receives this notice should read it closely, keep it for their records, and take the free protection EY is offering. Be careful with any call, text, or email about the incident that asks for personal details, passwords, or payment, and rely only on the contact information printed in the official notice.
People affected by an incident like this may also have legal options. A class action can let many affected people bring claims together, which can be a practical route when each person’s individual losses are modest but the exposure of their sensitive data is shared across a large group.
When Did This Breach Occur?
The Breakthrough letter does not state when the incident took place. EY’s related notices for other clients give a window of March 28, 2026 to April 12, 2026 for unauthorized access, and say EY confirmed anomalous activity on April 23, 2026.
Because the Breakthrough filing is a template that does not carry its own dates, the notice you receive in the mail is the best source for dates that apply to you.
What Information Was Breached?
According to the notice, the information involved varies by person and may include name, address, financial information about your investment such as capital contribution and return information, Social Security number, tax identifiers, LP or investor codes, and partial TINs.
EY states that bank account numbers, income, and net worth were not included. The letter’s list of the exact data elements for each recipient was left as a blank template field in the filed copy.
What You Can Do
If you received this notice, consider these steps:
- Read your notice carefully and keep it with your records.
- Enroll in the 24 months of complimentary Experian IdentityWorks coverage by the deadline printed on your own letter.
- Request your free credit reports from Equifax, Experian, and TransUnion through annualcreditreport.com and look for accounts you do not recognize.
- Consider a free fraud alert or security freeze on your credit file with each of the three credit bureaus.
- Watch for tax filings or IRS notices you did not expect, and consider requesting an IRS Identity Protection PIN.
- Report suspected identity theft to the Federal Trade Commission at IdentityTheft.gov and to your state attorney general.
File a Data Breach Lawsuit Against Breakthrough Worldwide
People whose Social Security numbers and tax information were exposed through a professional services provider may be able to bring claims against the organizations responsible, particularly where reasonable security steps were not taken.
If you were notified that your information was involved in this incident, it may be worth speaking with a lawyer about your options. Keep your notice and records of any fraud, or of the time and money you spent dealing with it.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
