Ernst & Young Discloses 2-Week Breach of Tax Data via Third-Party System
Updated
Updated · ZDNet · Jul 21
Ernst & Young Discloses 2-Week Breach of Tax Data via Third-Party System
3 articles · Updated · ZDNet · Jul 21
Summary
March 28 to April 12, attackers accessed a third-party support ticket platform used by EY and downloaded records tied to clients' tax work.
April 23, EY said it detected suspicious activity, hired a cybersecurity firm, secured the system, and began filing breach notices with states including California, Massachusetts and Vermont.
Tax-related financial information was stolen, but EY has not said how many clients were affected or exactly which data fields were exposed; it said it has no indication the information was specifically targeted or misused.
24 months of free Experian IdentityWorks and Identity Restoration are being offered to affected clients, who are also being urged to monitor accounts, consider freezing credit, and request an IRS identity protection PIN.