Personal information belonging to clients of Goldman Sachs’ wealth management business, Man Group, and Tishman Speyer has been exposed in a breach involving Ernst & Young LLP (EY), raising the stakes of an incident first disclosed in the summer. Letters sent to clients at the end of September said an unauthorized third party accessed the platform between 28th March and 12th April 2026, downloading documents connected to multiple EY clients. For customers, the practical question is therefore which records were involved and how the institution will help them respond. For financial firms, the incident illustrates how an external service relationship can generate client-facing responsibilities even without a compromise of their own network. The exposed information included names, addresses, tax identification numbers, email addresses, and financial details.[1]
EY stated that a hack occurred in July 2026 and attributed it to a vulnerability in Checkmarx software. However, the reports reviewed do not identify a specific CVE, affected software version, or detailed exploit method. The affected system was an IT service management platform that EY’s IT staff used to support internal teams handling tax work, and support tickets included attachments containing sensitive client tax information. This placed client documents in a support workflow outside clients’ networks.
EY detected unusual activity on 23rd April 2026, eleven days after the last reported unauthorized access. Working with an independent cybersecurity firm, investigators determined that documents had already been downloaded during the March - April access window. The delay matters because the theft took place before EY identified the suspicious activity. This incident illustrates how support systems can become a route to sensitive business data. In this case, access to a platform holding tax documents exposes information linked to several organizations without requiring a reported breach of those organizations’ internal systems.
Goldman Sachs said its systems were unaffected and that client assets remained safe. Man Group also confirmed that its systems were not compromised, describing the incident as involving third-party software used by EY. These statements distinguish the client-information exposure from a direct attack on either firm. In a 24th September letter, Goldman Sachs told clients that EY had engaged an independent cybersecurity firm to verify the affected systems were secure. Goldman’s technology risk team reviewed that work and requested objective evidence and third-party checks showing EY’s fixes were effective.
The available reports specifically attribute that demand to Goldman Sachs. They do not establish that Man Group made an identical request. EY said the incident did not affect its broader enterprise systems or threaten ongoing business operations, and that its review was nearing completion.
EY has told authorities in California, Texas, Massachusetts, and Vermont about the breach and about offering affected individuals credit monitoring and identity protection services through a third-party provider. EY’s July notice said it had no evidence that the exposed data had been misused or that individuals were deliberately targeted. That statement describes the findings at that stage, not a guarantee against later misuse.
The incident's wider significance lies in the gap between securing an organization’s own systems and protecting every copy of the information entrusted to it. The disclosures show how an adviser's supporting platform can expose clients further down the service chain, while leaving those clients’ financial institutions operationally unaffected.
This article used AI to craft the content and is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://www.cybersecurityintelligence.com/blog/ernst-and-young-breach-exposes-clients-9822.html
Comments