Ernst & Young Data Breach Exposes Social Security Numberes

Ernst & Young LLP, one of the "Big Four", disclosed a data breach that occurred in the spring of 2026. According to state filings, the breach affected 873 Texas residents, 480 Massachusetts residents and 13 Vermont residents.

The breach was reported to the California Attorney General.

EY identified unusual activity on March 23, 2026, according to the company's notification, and began notifying affected individuals through letters dated July 13, 2026, sent via U.S. Mail and email.

EY uses a third-party information technology service management platform to help its IT personnel provide support to teams performing tax-related work for clients. Support tickets submitted through the platform may include documents containing personal information. Because EY performs tax-related work for financial institutions, those documents could contain sensitive data about the institutions' customers.

Upon detecting the issue, EY's Information Security team began investigating to determine the nature and scope of the unauthorized access. Based on the investigation and available evidence, between March 28, 2026, and April 12, 2026, an unauthorized third party accessed the platform and downloaded documents pertaining to a number of EY clients. As disclosed in regulatory filings, the breach period extended through April 23, 2026.

The individuals affected by the breach are people whose personal information was held by financial institutions that use EY for professional tax services. These individuals may not have had a direct relationship with EY. Their personal data was provided to EY by the financial institutions in connection with investment-related tax work, as stated in the notification.

The personal information exposed in the breach included names, addresses, dates of birth, Social Security numbers, driver's license numbers, email addresses and phone numbers. Financial data was also compromised, including credit or debit card numbers, financial account codes and financial account information related to tax filings.

Ernst & Young's response

EY is offering affected individuals complimentary 24-month memberships to Experian IdentityWorks, a credit and identity monitoring service.

Affected individuals can activate the service through the enrollment link and personal activation code included in their notification letter. The deadline to enroll is 11:59 p.m. UTC on Oct. 31, 2026.

EY has set up a dedicated phone line for questions at 833-391-7884, available Monday through Friday from 8 a.m. to 8 p.m. CST, excluding major U.S. holidays. Individuals may also reach the company by email at Privacy.Notification@ey.com.