Ernst & Young (EY) Faces Scrutiny After Breach Exposes Sensitive Goldman Sachs and Man Group Client Information

EY suffered a third‑party platform breach that exposed personal and financial data belonging to clients of Goldman Sachs’ wealth‑management division and Man Group, after an attacker accessed and downloaded tax‑related documents between March 28 and April 12, 2026. The breach stemmed from a Checkmarx‑related vulnerability in a support‑ticket system EY used for tax services—not from any compromise of Goldman Sachs or Man Group’s own networks.

An unauthorized third party infiltrated a third‑party IT service management (ITSM) platform used by EY’s tax teams. This system stored attachments containing sensitive client tax documents. Once inside, the attacker downloaded files tied to multiple EY clients, including individuals associated with:

• Goldman Sachs Wealth Management

• Man Group, the UK‑listed hedge fund
  
  

EY detected suspicious activity on April 23, 11 days after the last unauthorized access. By then, the data theft had already occurred.

Across multiple disclosures, the compromised data included:

• Names and addresses

• Email addresses

• Tax identification numbers (TINs)

• Financial information, including account‑related details

• Tax‑filing documents and investment information (in some cases)
  
  

This information was stored in EY’s tax‑support workflow—not in Goldman Sachs’ or Man Group’s systems.

No. Both firms confirmed:

• Their internal systems were not breached

• Client assets remain secure

• The incident was entirely external, involving EY’s vendor platform
  

This distinction matters: the exposure occurred because EY placed sensitive tax documents inside a support system outside the clients’ networks.

The cybercriminal group ShinyHunters claimed responsibility on a dark‑web leak site in July. EY has not confirmed the claim.

ShinyHunters is known for breaching more than 140 organizations and extorting at least $70 million, according to FBI statements.

• Mar 28–Apr 12, 2026: Unauthorized access window

• Apr 23: EY detects unusual activity

• Jul 13–17: EY files breach notices with CA, VT, TX regulators

• Late September: EY sends expanded notices naming Goldman Sachs and Man Group clients
  
  

The gap between detection and public disclosure was 83–85 days, now a point of regulatory scrutiny. 

This incident highlights a growing industry problem:

• Third‑party platforms—especially IT support systems—are becoming the weakest link in enterprise security.

• Sensitive documents often flow through these systems without the same controls as core networks.

• Even top‑tier firms like EY can inadvertently expose high‑value client data through vendor dependencies.
  
  

For EY, whose business depends on trust and confidentiality, the reputational impact may exceed the technical severity.

Based on regulatory filings and industry guidance:

• Enroll in credit and identity monitoring offered by EY

• Monitor financial accounts for unusual activity

• Consider placing a fraud alert or credit freeze