Tishman Speyer Data Breach Compromises Social Security Numbers

Tishman Speyer, a major global real estate owner, developer and investment manager headquartered in New York City, disclosed a data breach that exposed personal information belonging to some of its investors.

The breach did not occur within Tishman Speyer's own systems. Instead, investor data was compromised through Ernst & Young LLP (EY), a third-party firm that provides professional tax services for the company and handled certain personal information about Tishman Speyer investors in the course of that work.

EY confirmed suspicious activity on April 23, 2026. EY notified Tishman Speyer that investor information may have been impacted on Aug. 6, 2026.

After working to identify the specific individuals whose data was involved, EY completed the review process on Aug. 25, 2026. Tishman Speyer then worked to get notifications out to affected individuals.

Based on EY's investigation and available evidence, between March 28, 2026, and April 12, 2026, an unauthorized third party gained access to EY's platform and downloaded documents pertaining to clients.

The types of information exposed included Social Security numbers. The consumer notification confirms that bank account numbers, income and net worth were not among the compromised data.

The breach was disclosed to the Massachusetts Office of Consumer Affairs and Business Regulation, with 24 Massachusetts residents reported as affected.

Tishman Speyer's response to the breach

EY is offering affected individuals 24 months of complimentary credit and identity monitoring through Experian IdentityWorks. Specific enrollment details, including unique activation codes and enrollment deadlines, are included in the individual notification letters sent to affected people.

For affected individuals outside the United States, EY is offering 24 months of Cyber Monitoring services through Cyberscout, a TransUnion company. Enrollment in Cyber Monitoring must be completed within 90 days of receiving the notification letter.

Individuals with questions can contact EY by email at Privacy.Notification@ey.com. U.S. residents may also reach a dedicated phone support line, available Monday through Friday from 8:00 a.m. to 8:00 p.m. Central Time, excluding U.S. holidays.