EY Data Breach Exposes Sensitive Information of Goldman Sachs and Man Group Clients

A cybersecurity incident involving Ernst & Young (EY) has exposed sensitive personal and financial information belonging to clients of Goldman Sachs, Man Group and other organizations.

The breach affected a third-party IT support platform used by EY's tax services operations. According to recent reporting, unauthorized individuals accessed the system between March 28 and April 12, 2026, downloading documents containing confidential client information.

What Information Was Exposed?

The compromised documents reportedly contained:

• Names and residential addresses
• Email addresses
• Tax identification numbers
• Personal financial information
• Tax-related records

The affected individuals include clients of Goldman Sachs' wealth management division and UK-listed investment manager Man Group. Information associated with investors in real estate company Tishman Speyer may also have been exposed.

The exact number of affected individuals has not been publicly confirmed.

How Did the Breach Happen?

EY identified suspicious activity on April 23, 2026, after attackers had already accessed and downloaded documents from a third-party IT service management platform.

The incident was reportedly linked to a vulnerability involving Checkmarx software, although the precise technical exploitation method and any associated CVE have not been publicly established.

The reported attack sequence was:

Third-Party Platform Compromised → Unauthorized Access → Support Documents Downloaded → Sensitive Client Data Exposed

The incident highlights how sensitive information stored in support tickets and their attachments can become accessible through systems outside an organization's primary production environment.

Goldman Sachs and Man Group Confirm Their Systems Were Not Breached

Both financial organizations clarified that their internal infrastructure remained unaffected.

Goldman Sachs confirmed that its systems were not compromised and that client assets remained secure. The bank also requested independent evidence that EY's remediation measures were effective.

Man Group similarly stated that the incident involved third-party software and did not compromise its own systems.

EY said the breach did not affect its broader enterprise infrastructure or ongoing business operations.

ShinyHunters Claims Responsibility

The cybercrime group ShinyHunters claimed responsibility for the attack in July 2026.

However, the group's statements about the intrusion and its broader scope have not been independently verified in full.

EY reported the incident to regulatory authorities in California, Texas, Massachusetts and Vermont and engaged an independent cybersecurity firm to investigate.

What Organizations Should Learn

The incident demonstrates that sensitive client information can be exposed even when the affected organization's own infrastructure remains secure.

Security teams should prioritize:

• Reviewing third-party software and service-provider risks
• Restricting access to sensitive support-ticket attachments
• Enforcing least-privilege access controls
• Monitoring unusual downloads and account activity
• Applying security updates promptly
• Encrypting sensitive financial and tax records
• Independently validating incident remediation

Security Takeaway

The EY breach highlights the growing importance of third-party security and data protection.

Organizations should evaluate not only the security of their internal systems but also how external service providers store, process and access confidential customer information.