EY breach leaks tax data of Goldman Sachs and Man Group clients

Ernst & Young disclosed that a security incident on a platform used for its tax advisory services resulted in the exposure of personal and financial details belonging to clients of Goldman Sachs' wealth management arm and the investment firm Man Group.

The compromised data stemmed from EY's own technology environment, not from the networks of the two financial institutions themselves. According to the firm, the breach was identified during a routine audit, prompting an immediate investigation and notification to affected parties.

Among the information reportedly accessed were taxpayer identification numbers, account balances, and transaction histories that clients had provided to EY for tax filing and reporting purposes. While the breach did not affect the core banking or investment systems of Goldman Sachs or Man Group, the sensitivity of the leaked data raises concerns about potential identity theft and fraudulent activity.

EY has pledged to cooperate fully with regulatory authorities and to implement additional safeguards to prevent future incidents. The firm also indicated that it is offering affected individuals credit monitoring services and advice on steps to mitigate any misuse of their data.

The episode underscores the broader risk that professional service firms face when handling large volumes of client financial information. As regulators worldwide tighten data protection standards, firms like EY are under increasing pressure to demonstrate robust cybersecurity measures, especially when serving high‑net‑worth individuals and institutional investors whose data is a prime target for cybercriminals.