A company can protect its own network and still face a privacy problem when sensitive information travels through a service provider’s workflow, as the EY breach involving Goldman Sachs and Man Group shows. Tax files, identity details, and financial information may pass through tools built for everyday support. A small attachment can create a larger concern when it holds private records.
That risk reaches beyond technology teams. Clients may want to know what happened to their records, while investors may weigh how firms manage outside providers. The incident also raises practical questions about security at professional services firms, where support tools can sit between a firm and its clients. This update explains the known facts and offers clear steps for affected readers. The useful question for an affected reader is what information was involved and what protective steps are available.
Key Takeaways
- An outside support workflow can hold sensitive client records.
- EY said an unauthorized third party downloaded client documents.
- The financial firms named in connection with the incident said their own systems were not compromised.
- Each individual’s notice identifies which information may have been involved.
- A credit freeze and identity monitoring serve different purposes.
EY Breach Goldman Sachs Man Group Data 2026: What Happened?
An unauthorized third party accessed an EY support platform and downloaded documents associated with EY clients. Attachments made routine tax-support tickets a possible storehouse for private client files.
An IT service-management (ITSM) platform is software used to manage service requests and support tickets, including their file attachments. The platform supported EY client tax work, and ticket attachments could contain tax information. EY said the third party downloaded client documents through that support platform.
A downloaded attachment can carry the same sensitivity as a file stored in a tax system.
The platform vendor was not publicly identified. The Financial Times reported a vulnerability involving Checkmarx software, but EY’s quoted breach notice did not name Checkmarx. A report about software linked to a vulnerability does not establish who operated the platform or how the third party entered it.
For readers, that distinction matters: a software name alone does not identify the affected service provider. The tax documents were tied to EY’s client work, but the third-party operator remains unnamed. Keep the software vulnerability report distinct from the identity of the platform’s operator.
How the March-April Access Window Unfolded
The unauthorized access began on March 28 and ended on April 12, 2026. Detection followed after the access period had closed, and letters came later.
The access and detection dates
The sequence marks three points: the period when a third party reached the platform, EY’s discovery of unusual activity, and the first dated notices. The access lasted from March 28 through April 12, and EY detected anomalous activity on April 23. That gap helps explain why detection and access dates differ.
The term “anomalous activity” means activity that stood out from expected system behavior. EY’s detection date came 11 days after the access window ended. It does not change the dates when documents were accessed.
| Date | Event | Significance |
|---|---|---|
| March 28-April 12, 2026 | Access to the platform | Documents were downloaded |
| April 23, 2026 | Anomalous activity detected | Access window had ended 11 days earlier |
| July 13, 2026 | Notification letters dated | Affected individuals began receiving notice |
The first notification milestone
Letters dated July 13 gave affected individuals a written notice of the incident. Those notices mark a separate point from the earlier access and detection dates. A letter’s date can help a recipient identify which communication relates to the event, especially when several firms handled connected records.
For a person who received a notice, the letter is more useful than the broad timeline for understanding personal impact. The letter may name the individual’s information and explain any offered services. EY’s April 23 detection came 11 days after the reported access window closed.
What Personal and Financial Information Was Exposed?
The potentially exposed information ranged from basic identifiers to financial and tax details. Individual notices explain which fields applied to each person.
Personal identifiers
Information involved included names, addresses, and Social Security numbers. Those details can help someone pose as another person or make a fake message seem real. The specific information varied by affected individual, so a general list cannot show each person’s exposure.
A person’s name alongside an address or Social Security number may support identity theft attempts. An attacker could also use personal details to make a phishing message appear tied to a tax matter. The incident does not establish that anyone misused the information.
Tax and financial records
Some records included account numbers, credit and debit card numbers, and other tax-related information. The mix matters because financial details can create risks beyond basic identity theft. Tax information may also help someone build a false tax filing or target a person with a convincing message.
These are possible risks, not proof of fraud or misuse. A person should use the notice received directly to identify the data fields at issue, rather than assume every listed category applies. That notice may distinguish identifiers from financial records and other tax information.
Keep the letter with other personal records, and check its contact details before sharing further information. The categories in a public account describe the incident broadly, while an individual notice ties the facts to one recipient. For an individual’s next steps, the fields listed in that person’s notice matter more than a general category list.
Which Clients and Investors Were Affected?
The reported exposure included people associated with Goldman Sachs wealth management, Man Group, and Tishman Speyer investors. Those links describe whose information may have been involved, not a direct attack on each firm’s network.
Goldman Sachs and Man Group said their own systems were not affected or compromised. Goldman Sachs also said client assets remained safe. These statements concern each firm’s systems and assets, while the records at issue were handled through EY’s support work.
| Firm | People linked to the exposure | What is known about its own systems |
|---|---|---|
| Goldman Sachs | Wealth-management clients | Systems not affected; client assets remained safe |
| Man Group | Individuals connected to the firm | Own systems not compromised |
| Tishman Speyer | Investors identified among people who may have been affected | No system statement provided here |
EY’s September 2026 notifications identified people connected to Goldman Sachs and Man Group. Tishman Speyer investors were also identified among people whose information may have been affected. The table does not mean every client, investor, or staff member at those firms received a notice.
Someone may have exposed information even when the firm that first collected it kept its own systems intact. The reported connection is to records handled in a third-party workflow, not proof of a breach at the financial firm. Describe these groups as linked to exposed information, not as proof that their own systems were breached.
What Has EY Done Since the Incident?
EY said it stopped the unauthorized access and brought in an independent cybersecurity firm to investigate. Its response also included notices to law enforcement and regulators.
Investigation and containment
EY said it notified federal law enforcement and hired an independent firm to examine the incident. The company also said it stopped the unauthorized access. State filings in July 2026 identified at least 1,866 individuals. California, Texas, Massachusetts, and Vermont received notices.
California’s cited rule calls for a sample notice to the attorney general when an organization notifies more than 500 California residents. The University of California’s breach decision tree describes that notice requirement. Such filings give regulators notice of the event and the affected-person count.
Notices, monitoring, and legal action
Separate developments involved affected individuals, public claims, and a court filing. ShinyHunters listed EY on its leak site on July 27, 2026, and set July 31 as a contact deadline. That deadline was ShinyHunters’ demand, not an action by EY or a regulator.
- State notices filed in July named at least 1,866 affected individuals.
- Man Group individuals received an offer of 24 months of Experian identity-monitoring services. Enrollment was scheduled to expire October 31, 2026.
- Goldman Sachs wrote to wealth-management clients on September 24, 2026.
- A proposed class action was filed in July 2026 in the U.S. District Court for the Southern District of New York. Its allegations have not been established in court.
The monitoring offer applied to affected Man Group individuals, with its own stated enrollment date. The lawsuit represents a separate legal process from EY’s investigation and the leak-site post. The lawsuit’s allegations remain allegations, not findings established by a court.
What Should Affected Individuals Do Now?
A credit freeze is a proactive step, while monitoring is a way to receive alerts about activity. They serve different purposes: a freeze can block new credit accounts, while monitoring reports signs of possible misuse.
The Federal Trade Commission says credit freezes are free at Equifax, Experian, and TransUnion. A freeze does not stop every form of fraud, but it can make it harder for someone to open new credit in a person’s name. The IRS offers an Identity Protection PIN to help prevent tax-return fraud.
- Consider placing a freeze with Equifax, Experian, and TransUnion.
- Enroll in any identity-monitoring service offered directly to you.
- Consider requesting an IRS Identity Protection PIN.
- Review bank and card activity for charges or changes you do not recognize.
- Treat unexpected breach-related messages as possible phishing.
Check account activity through the bank or card issuer’s usual app or phone number. Monitoring may alert a person to activity, but it does not stop a new account from opening. For help securing online accounts, follow guidance on password managers and unique passwords, then turn on multifactor authentication where available.
A message that mentions the incident may still be a scam. Verify any unexpected message through a contact method already known to you, not through a link in the message.
What the Breach Shows About Vendor Security
A help-desk tool can become a sensitive-data repository when employees attach real client files to routine tickets. Small workflow choices can place data outside a company’s main records system.
Support tickets can collect tax files, screenshots, and other records that staff add while seeking help. NIST Cybersecurity Framework 2.0, released in February 2024, sets out six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Organizations should map those functions to the actual path client data takes through vendors.
Before sharing a client file through a support tool, decide whether the ticket needs the full file at all.
- Minimize data by keeping sensitive fields out of routine support requests.
- Redact attachments or block files that contain private client details.
- Use least-privilege access and multifactor authentication.
- Set clear retention periods and delete attachments when no longer needed.
- Monitor systems for unusual downloads from support platforms.
Vendor reviews should cover subcontractors and other downstream providers, not just the main service contract. Teams comparing cloud services can also review how AWS, Azure, and Google Cloud handle security controls. A customer-facing breach can also show how detailed records make phishing more convincing; see this Manchester Airports customer-data incident for a related example. Ask vendors to identify downstream providers that can access the information and how long each party retains it.
Conclusion
The central lesson is that privacy risk can follow information beyond the organization that collected it. A service provider may hold client records even when a client’s own systems remain intact.
That makes the individual notice a useful place to start. It can show which records and identifiers were tied to a person, rather than leaving them to guess from broad reports. Keep the notice and its contact details available while checking any service instructions it includes.
For investors and clients, the incident also shows why vendor access and attachment practices matter. A company can secure its own network and still depend on outside tools that handle sensitive work.
If you received a notice and need clarification, contact the organization through the channel printed in that notice.
FAQ
Was the EY support-platform vendor identified publicly?
No, the company operating EY’s support platform was not publicly identified. The Financial Times reported a vulnerability involving Checkmarx software, but EY’s quoted notice did not name Checkmarx. A report about a software vulnerability does not confirm which vendor ran the platform. It also does not, by itself, explain how the third party gained access.
Did Goldman Sachs or Man Group systems get breached?
No, Goldman Sachs and Man Group said their own systems were not compromised. Goldman Sachs also said client assets remained safe. The exposed records were connected to EY’s work through its support platform, so information could be involved without a direct breach of either firm’s network. A notice to an individual is the best way to confirm personal impact.
Did ShinyHunters prove it accessed EY’s Jira, GitHub, and Azure environments?
No, ShinyHunters made that claim, but EY had not confirmed it. A statement on a leak site is a claim, not independent proof of access to those environments. The confirmed incident concerned an EY support platform and downloaded client documents. Readers should keep that known event separate from the group’s broader claims about other systems.
Could my information be affected if my financial firm’s own systems were not breached?
Yes, records handled through EY could be exposed downstream even if a financial firm’s own systems were not breached. Companies often use outside providers to support client work, and those workflows may hold documents or attachments. A person’s notice can say whether their information was involved and which fields were affected. The firm’s system statement does not answer that personal question by itself.
Can identity monitoring prevent someone from opening an account in my name?
No, identity monitoring mainly alerts a person to activity; it does not block someone from opening a new credit account. A credit freeze can block new credit accounts while it remains in place. The two tools have different jobs, so an alert service is not a substitute for a freeze. The Federal Trade Commission says freezes are free at the three major credit bureaus.
What should I check in an EY notification letter?
Check which information categories the notice lists for you, then follow its instructions and enrollment deadline. Notices may differ because the information involved varied by individual. Review the contact details and service terms in your own letter, rather than relying on another person’s notice. If a point is unclear, use the contact channel printed in the letter to ask about your records.
