EY Investigates Data Breach from Compromised Third-Party Support System

Third-Party Vendor Risk Highlights Need for Robust Oversight

The recent data breach at Ernst & Young (EY), one of the 'Big Four' professional services firms, underscores the critical importance of managing third-party vendor risk. The incident originated from a compromised third-party IT support system used by EY's internal IT teams, which stored support tickets and client documents, including sensitive tax information. This event serves as a stark reminder for internal audit and assurance professionals that an organization's cybersecurity posture is only as strong as its weakest link, often found within its supply chain or external service providers.

Key Details of the Breach and EY's Response

EY detected anomalous activity on April 23, 2026, and promptly initiated an incident response, engaging an independent cybersecurity firm. Their investigation revealed that an unauthorized third party had accessed the platform and downloaded documents between March 28 and April 12, 2026. The compromised data included personal and financial information used for tax filings. While EY has secured its systems and notified federal authorities, they currently have no evidence of misuse of the exposed data or targeted attacks. As a compensatory measure, EY is offering 24 months of identity monitoring and restoration services through Experian to affected clients.

Implications for Internal Audit and Assurance Professionals

This incident provides several key takeaways for internal audit and assurance functions:

• Enhanced Third-Party Risk Assessments: Audit teams must ensure that robust due diligence and continuous monitoring processes are in place for all third-party vendors, especially those handling sensitive client data. This includes evaluating their security controls, incident response capabilities, and contractual obligations regarding data protection.
• Data Minimization and Classification: Organizations should review their data retention policies and practices to ensure that sensitive information is only stored where absolutely necessary and for the shortest possible duration. Proper data classification can help prioritize protection efforts.
• Incident Response Preparedness: The speed and effectiveness of EY's incident response, including engaging external experts and notifying authorities, highlight the importance of a well-defined and regularly tested incident response plan.
• Client Communication and Support: Offering identity monitoring and restoration services demonstrates a commitment to affected parties, which can be crucial for maintaining trust and mitigating reputational damage. Internal audit should assess the adequacy of such post-breach support mechanisms.