EY Data Breach Exposes Client Data of Goldman Sachs and Man Group

This incident reveals critical vulnerabilities in the financial services supply chain, emphasizing the need for robust cybersecurity measures.

• Unauthorized access to EY’s IT service-management platform exposed client data linked to Goldman Sachs and Man Group.
• Client notifications were issued in late September 2026, following the detection of the breach in April.
• No confirmed total of affected individuals, but at least 1,366 U.S. residents are referenced in regulatory filings.

• Financial institutions often depend on professional services firms like EY for tax and advisory work, creating indirect exposure points for sensitive data.
• The breach was linked to a vulnerability in Checkmarx software, affecting multiple organizations and highlighting systemic risks in vendor management.
• Goldman Sachs and Man Group confirmed their internal systems were secure, but the incident raises questions about the overall security of client data in the financial sector.

The EY data breach is a stark reminder of the vulnerabilities inherent in the financial services supply chain. As firms increasingly rely on third-party vendors for essential services, the risk of data exposure grows. In this case, unauthorized access to EY's IT service-management platform allowed a third party to download sensitive client documents, including tax information, between March 28 and April 12, 2026.

EY detected anomalous activity on April 23, 2026, and promptly engaged external cybersecurity experts while notifying law enforcement. However, the breach was not reported to U.S. regulators until July 2026, raising concerns about the timeliness of their response. The delay in notification could have left clients vulnerable for months, highlighting a critical gap in breach response protocols.

Goldman Sachs and Man Group, both major players in wealth management and investment, confirmed that their internal systems remained uncompromised and that client assets were unaffected. This assurance is crucial for maintaining client trust, but it does not mitigate the broader implications of the breach. The incident underscores the need for financial institutions to scrutinize their vendor relationships and ensure that third-party service providers adhere to stringent cybersecurity standards.

The breach also reflects a growing trend in the financial sector where third-party vendor risks are increasingly scrutinized. As firms like EY process sensitive tax and investment data, the potential for exposure rises. The incident has prompted discussions about the adequacy of existing cybersecurity measures and the need for enhanced oversight of third-party vendors.

In the aftermath, EY has offered credit monitoring services to affected clients, but the long-term implications of this breach may extend beyond immediate financial concerns. The incident could lead to increased regulatory scrutiny of cybersecurity practices within the financial services sector, as well as a reevaluation of how firms manage their vendor relationships.

• Wealth management clients of Goldman Sachs and Man Group, who may experience anxiety over data security.
• Financial institutions that rely on EY for tax services, facing potential reputational damage and increased scrutiny.
• Cybersecurity professionals tasked with enhancing defenses against third-party vulnerabilities.

• Regulatory responses: Monitor for any new regulations or guidelines aimed at strengthening cybersecurity measures for third-party vendors in the financial sector.
• Market reactions: Watch how financial institutions adjust their vendor management strategies in response to this breach, potentially leading to increased costs or changes in service providers.
• Client trust: Observe any shifts in client behavior or sentiment towards firms involved, particularly regarding their willingness to share sensitive information.