EY's breach: your vendor's helpdesk is a document archive

Ernst & Young is notifying clients that an unauthorized party got into a third-party support ticket system used by its IT staff and downloaded documents. The exposed material included personal and financial data contained in — or used to prepare — tax filings. Not a client portal. Not the tax platform. The ticketing tool the internal help desk runs on. That's the EY data breach detail worth sitting with, because almost every business has the same system and has never once thought about what's inside it.

What actually happened

Per BleepingComputer, the intruder had access between March 28 and April 12, 2026. EY detected anomalous activity on April 23, engaged an outside cybersecurity firm, and notified federal law enforcement. Breach notifications were filed with the California Attorney General on July 15 — roughly three months after detection. EY says it has no indication specific individuals were targeted and is offering 24 months of Experian identity monitoring.

EY hasn't named the ticketing vendor, hasn't said how many people were affected, and hasn't confirmed whether the impact extends beyond U.S. clients. SecurityWeek reports no extortion group has claimed it. The concrete, uncontested fact is the one that generalizes: support tickets submitted through the platform carried attachments containing client tax information.

Why it matters for your business

Ticketing systems accumulate the worst possible data by accident. Someone can't get a return to open, so they attach the return. A payroll import fails, so the CSV goes in the ticket. A card gets declined, so a screenshot of the statement gets pasted in. Every one of those is a reasonable thing to do to solve a problem today, and every one leaves a permanent copy in a system nobody classifies, nobody audits, and nobody prunes. Your CRM has a retention policy. Your help desk almost certainly doesn't.

The fix isn't "stop attaching things." Support work needs artifacts. The fix is that the artifact shouldn't be a document.

Ask for identifiers, not files. An invoice number, an order ID, a record link. Support can pull the document from the system of record where access is logged and revocable. The ticket references it instead of containing it.

Put an expiry on attachments. Most modern help desks support attachment retention rules. Ninety days after close is generous for the vast majority of tickets. If your tool can't do it, that's a real evaluation criterion for the next one.

Check both directions. You upload into your vendors' ticketing systems too — your accountant's, your payroll provider's, your bank's. You can't set their policy, but you can decide what leaves your building. Send the account number, not the statement.

Sources: BleepingComputer, SecurityWeek.