Ernst & Young Data Breach Exposes Client Tax Records: Edelson Lechtzin LLP Investigates Class Action Claims

National data breach law firm offering free case evaluations to Ernst & Young clients whose personal and financial tax information may have been exposed after an unauthorized third party accessed a compromised support system.

NEWTOWN, Pa., July 19, 2026 /PRNewswire/ -- Edelson Lechtzin LLP, a national class action law firm, is investigating data privacy claims arising from the Ernst & Young (EY) data breach, a cybersecurity incident that exposed personal and financial information contained in or used to prepare client tax filings. Ernst & Young began notifying affected clients in July 2026, after determining that an unauthorized third party had accessed a third-party support ticket system used by its IT personnel and downloaded documents that may have contained client tax information.

What Happened

On April 23, 2026, Ernst & Young detected anomalous activity on its networks and immediately launched an investigation with the assistance of external cybersecurity experts. That investigation determined that, between March 28, 2026, and April 12, 2026, an unauthorized third party accessed a third-party IT service management platform used to support EY employees working on client tax services and downloaded multiple documents belonging to a number of EY clients. EY notified affected individuals through a filing with the California Department of Justice and states that it secured its systems, removed the unauthorized access, and notified federal law enforcement. According to reports, EY has not publicly disclosed how many clients were affected, which third-party provider was involved, or whether the incident is limited to its U.S. client base.

Information Exposed

The Ernst & Young data breach may have compromised personal and financial information contained in, or used to prepare, client tax filings. Support tickets submitted through the affected platform may have included attached documents containing sensitive personal and financial data. Because tax records combine identifying and financial details, affected individuals may face an increased risk of identity theft, tax fraud, and targeted phishing or social engineering attacks.

Who Is Behind the Ernst & Young Data Breach?

As of Ernst & Young's disclosure, no data extortion or ransomware group has publicly claimed responsibility for the attack, and EY has not identified the threat actor responsible or the third-party vendor whose platform was compromised. EY has stated that it is not aware of any misuse or further exposure of the affected files and has no indication that particular individuals were specifically targeted. Separately, in October 2025 it was reported that a 4-terabyte SQL Server backup file associated with EY had been left publicly accessible on Microsoft Azure; EY stated that this earlier issue was localized to an entity acquired by EY Italy and that no client information, personal data, or confidential EY data was impacted.

Who May Be Impacted

Ernst & Young clients who receive a data breach notification — including individuals whose personal or financial information appeared in documents submitted to prepare their tax filings — may face an increased risk of identity theft and fraud.

Your Legal Options

Edelson Lechtzin LLP is investigating a potential class action to pursue legal remedies on behalf of individuals whose sensitive personal and financial information may have been compromised in the Ernst & Young breach. The firm will evaluate your rights and potential claims at no cost.

Contact Us for a Free Case Evaluation

Speak confidentially with a data privacy attorney today: Marc Edelson, Esq., Edelson Lechtzin LLP, 411 S. State Street, Suite N-300, Newtown, PA 18940; Phone: 844-696-7492 ext. 2; Email: [email protected]; Web: www.edelson-law.com. Or click HERE to request a free consultation.

Recommended Protective Steps

Review account statements, credit reports, and tax records regularly and remain vigilant for suspicious activity. If Ernst & Young offered you complimentary identity monitoring and restoration services through Experian, consider enrolling before the October 31, 2026 deadline stated in the notice. Confirm whether your information was involved in the incident and preserve any letters or emails you received about the breach. Consider placing fraud alerts and credit monitoring, and consider requesting an IRS Identity Protection PIN to guard against tax-related fraud.

About Ernst & Young

Ernst & Young (EY) is one of the world's four largest auditing and professional services firms, providing assurance, tax, consulting, and strategy services to organizations in more than 150 countries. EY employs more than 400,000 people worldwide.

About Edelson Lechtzin LLP

Edelson Lechtzin LLP is a national class action law firm with offices in Pennsylvania and California. In addition to data breach litigation, the firm handles class and collective actions involving securities and investment fraud, federal antitrust violations, ERISA employee benefit plans, wage theft, and consumer fraud

Media and Partnership Inquiries: Use the contact information above to connect with our team regarding interviews, co-counsel opportunities, and referral partnerships.

Legal Notice: This press release may be considered Attorney Advertising in some jurisdictions.

SOURCE Edelson Lechtzin LLP