Professional services giant Ernst & Young (EY) has started notifying its clients that their personal and financial information was compromised in a data breach.
The incident was discovered on April 23 and involved a third-party service management platform that EY uses to support tax-related work it performs on behalf of its clients.
“Support tickets submitted through the platform may include documents containing client tax information,” the company wrote in a notification letter sent to clients, a copy of which was filed (PDF) with the California Attorney General’s Office.
After identifying anomalous activity on the platform, EY activated incident response and began remediation and recovery efforts. It also engaged an independent cybersecurity firm to investigate the nature and scope of the attack.
The hackers, it says, had access to the compromised platform between March 28 and April 12, and downloaded documents of EY clients.
Personal and financial information contained within those documents includes names, addresses, Social Security numbers, account numbers, credit/debit card numbers, and other types of information used to prepare tax filings, EY told the Texas AGO.
The company says it is not aware of any misuse or further exposure of the affected clients’ personal information, but is providing them with two years of free credit monitoring, identity monitoring, and identity restoration services.
EY has not shared details on how the attack occurred, nor on the threat actor responsible for it, and no known ransomware or extortion group appears to have claimed responsibility for the incident.
SecurityWeek has emailed Ernst & Young for additional information on the data breach and will update this article if the company responds.
Related: Hugging Face Hacked in Autonomous AI Attack
Related: Synopsys Finds No Evidence of Data Breach Amid Bosch Hack Claims
Related: Centers Laboratory Data Breach Affects 540,000 Individuals
Related: 12 Million Impacted by Data Breach at Japanese Telco KDDI
https://www.securityweek.com/ernst-young-data-breach-affects-personal-financial-information/
