Ernst & Young Reports Data Breach From Third-Party System Hack

Ernst & Young (EY) announced a data breach on March 20, 2024, stemming from a security incident involving a third-party support ticket system. This system is utilized by EY's IT personnel to manage and resolve technical issues. The breach occurred when unauthorized actors gained access to this external platform, potentially exposing sensitive information.

EY stated that the compromised system contained information related to client engagements and internal IT support tickets. While the full scope of the data exfiltration is still under investigation, the company is proactively notifying affected clients and individuals. The firm is working closely with the third-party vendor to understand the extent of the compromise and to implement enhanced security measures.

In response to the incident, EY has initiated a thorough review of its third-party vendor security protocols. The company is also offering identity protection and credit monitoring services to individuals whose data may have been affected. EY has not disclosed the name of the third-party vendor involved in the breach, citing ongoing investigations and privacy concerns. The firm emphasized its commitment to protecting client data and maintaining trust.