EY data breach: tax documents downloaded from an IT support ticket platform

Date	Event
March 28 to April 12, 2026	Unauthorized third party accesses the platform and downloads documents
April 22, 2026	EY identifies anomalous activity in its instance of the platform, per Man Group's notice
April 23, 2026	EY confirms the anomalous activity
Week of July 13, 2026	Letters by email and post; reports to New Hampshire (44) and Massachusetts (480)
July 31, 2026	EY tells Man Group, one of its clients, of the breach
September 21, 2026	Man Group reports its own investors to New Hampshire
October 31, 2026	Enrollment deadline for the Experian monitoring in EY's letter

What happened at EY?

The platform was not EY's own. EY's counsel told New Hampshire that EY uses a third-party IT service management platform so its IT staff can support teams doing tax work for institutional clients, and that EY received personal data about individuals from those clients in the course of the work. The letter to individuals explains why tax data was on an IT support system: support tickets submitted through the platform may include documents containing client tax information.

EY confirmed anomalous activity on April 23, 2026, worked with an independent cybersecurity firm, and notified federal law enforcement. Neither notice names the platform's provider, how the third party got in, or whether a ransom was demanded. The access ran for about two weeks and ended ten days before EY found it.

Why did I get an EY breach letter? I am not an EY client.

Because a fund or bank you invest with is. EY's letter says it provides tax services to financial institutions and received information about the recipient's investment holdings with a named EY customer. Some of those institutions are also notifying their own investors. Man Group told New Hampshire on September 21, 2026 that EY informed it of the breach on July 31 but gave no further details then. EY sent fuller details on August 28 and September 14. An investor can therefore get two letters about one incident, one from EY and one from the fund. The guide to letters from a company you never dealt with covers this case.

What information was exposed?

EY lists Social Security number, taxpayer identification number, address, name, financial account number, and financial information contained in or used to prepare tax filings for its institutional clients. Massachusetts marks Social Security numbers only. EY says it is not aware of misuse and has no sign that any one person was specifically targeted.

Record	People	Data it marks
Massachusetts OCABR, report 2026-1146	480	Social Security numbers
New Hampshire DOJ notice, July 15, 2026	44	SSN, TIN, name, address, account number, tax-filing data
Man Group notice to New Hampshire, September 21, 2026	1	Man Group investor data held by EY

What is EY offering?

Twenty-four months of Experian IdentityWorks credit and identity monitoring, plus Identity Restoration, which needs no enrollment. The enrollment deadline was 11:59 p.m. UTC on October 31, 2026. That date has passed. EY's counsel told New Hampshire that EY offers the service to everyone affected, even where the law may not require it. With a Social Security number and tax figures in the documents, a credit freeze is the stronger step, along with watching for a tax return filed in your name. See the credit monitoring guide and, for other professional-services firms' letters, the guide to letters from CPA and advisory firms.

What the documents leave open

• The name of the IT service management platform and how the third party got into it.
• The total number of individuals and institutional clients affected.
• Why EY told at least one client, Man Group, more than three months after confirming the activity.