Professional services giant Ernst & Young (EY) has started notifying its clients that their personal and financial information was compromised in a data breach.
The incident was discovered on April 23 and involved a third-party service management platform that EY uses to support tax-related work it performs on behalf of its clients.
“Support tickets submitted through the platform may include documents containing client tax information,” the company wrote in a notification letter sent to clients, a copy of which was filed (PDF) with the California Attorney General’s Office.
After identifying anomalous activity on the platform, EY activated incident response and began remediation and recovery efforts. It also engaged an independent cybersecurity firm to investigate the nature and scope of the attack.
The hackers, it says, had access to the compromised platform between March 28 and April 12, and downloaded documents of EY clients.
