EY Ernst Young data breach class action lawsuit third party platform tax records
EY faces a proposed class action after an unauthorized third party accessed a service-management platform used by EY tax staff and downloaded client documents between March 28 and April 12, 2026, per CFO Dive. EY began notifying affected individuals on July 13.
EY is facing a proposed class action lawsuit after a cybersecurity incident in which an unauthorized third party accessed a third-party IT service-management platform used by EY personnel supporting tax-related client work, according to CFO Dive and other outlets. EY's investigation found the unauthorized access occurred between March 28 and April 12, 2026, during which documents containing client information were downloaded. The firm began notifying affected individuals on July 13 and is offering complimentary identity monitoring and restoration services through Experian IdentityWorks. The lawsuit alleges EY failed to adequately protect sensitive financial and tax information, exposing affected individuals to risks including identity theft and tax fraud. The case underscores a recurring exposure for large professional-services firms: breaches increasingly originate not in a company's own systems but in the third-party platforms its staff use every day, a supply-chain risk that is harder to audit and control directly.