What Happened

EY suffered a data breach after an unauthorized third party accessed a Checkmarx software platform used by the firm's tax services between 28 March and 12 April 2026. The attacker exploited a vulnerability in Checkmarx's software and downloaded documents containing personal and financial information of EY clients.

EY reported the incident to the California Attorney General on 15 July 2026, with additional notifications to authorities in Texas, Massachusetts, and Vermont. The cybercriminal group ShinyHunters claimed responsibility in July.

Who Is Affected

Affected individuals include clients of Goldman Sachs' wealth management division, hedge fund manager Man Group, and global property developer Tishman Speyer. Exposed information includes names, addresses, email addresses, tax identification numbers, and financial information.

Goldman Sachs, Man Group, and Tishman Speyer all confirmed their internal systems were not compromised, and the breach was limited to third-party software used by EY. EY has offered affected individuals credit monitoring and identity protection services.

Market Impact

This breach highlights third-party software risk at Big Four firms and creates immediate buying triggers for security vendors.

• Third-party risk management: EY and similar firms need tools to audit vendor security postures and prevent software supply-chain breaches.
• Breach response: EY has engaged an independent cybersecurity firm, but follow-on remediation and litigation support will be needed.
• Supply-chain security: Checkmarx's vulnerability shows the need for continuous monitoring and security testing of third-party code and platforms.

What to Watch

Proposed class-action litigation has been filed against EY in the US District Court for the Southern District of New York, alleging inadequate cybersecurity safeguards. Expect further disclosures as EY's investigation completes and as regulatory reviews progress.

Also watch for similar incidents at other Big Four firms using integrated third-party platforms, as this breach already expands the publicly identified group of affected clients several months after initial notification.

Related coverage

• Ransomware crews exploit critical JetBrains TeamCity RCE flaw CVE-2026-63077
• Data breach at IDScan.net may have exposed 150M+ driver's license images
• Telus Warns Customers of Account Breaches
• Manchester Airports Group breach: FulcrumSec claims 86GB data theft after MAG discloses 8.7M customer breach