A breach of a third-party platform that Ernst & Young uses for tax work is now at the center of a proposed class action, after notices warned that client Social Security numbers and financial details may have been taken. If you got an EY breach letter, here is what the case does — and does not — mean for you right now.
Allegations Only · No Settlement Yet
This article describes a proposed class action complaint. The statements below are unproven allegations. Ernst & Young has not been found liable, no class has been certified, and there is nothing to claim at this time. This page is informational and is not legal, financial, or tax advice.
What Is This About?
Ernst & Young (EY), one of the "Big Four" accounting firms, is facing a proposed class action over a data breach that reportedly exposed sensitive client information, including tax and financial data. According to breach notices, an unauthorized party accessed a third-party IT platform EY uses to support tax-related work for clients and downloaded documents. A proposed class action was filed in July 2026 in the U.S. District Court for the Southern District of New York, alleging EY failed to adequately safeguard the data and that affected individuals now face heightened risks of identity theft and fraud. The allegations are unproven, and no class has been certified.Based on the notices and state-regulator filings, EY has reported that the unauthorized access occurred over a period in spring 2026 and that it detected the anomalous activity in late April 2026. EY began notifying affected individuals in mid-July 2026 and reported the incident to several state attorneys general, including in California, Massachusetts, Vermont, and Texas. EY has said it is offering complimentary identity monitoring and restoration services through Experian IdentityWorks.
How the Breach Reportedly Happened
The exposure did not stem from EY's core systems being hacked directly, according to the notices, but from an unauthorized party gaining access to a third-party platform EY relies on to support tax-related client work and downloading documents stored there. This "third-party/vendor" pattern — where the weak point is a supporting service rather than the primary company — is a recurring theme in recent breach litigation. EY has described taking steps to investigate and respond and has begun individual notifications; the company has not been found to have done anything unlawful.Who Is Affected
EY has not publicly stated a single total for how many people were affected. State breach-notice filings show the incident touched residents across multiple states — for example, filings referenced hundreds of affected residents in Texas and Massachusetts and a smaller number in Vermont — which suggests a broader national pool once all states report. The most reliable signal for any individual is whether they received a notification letter or email from EY; that notice describes the specific data elements involved for that person.What the Lawsuit Seeks
The proposed class action generally seeks to hold EY responsible for allegedly failing to protect the data and for the resulting risks to affected individuals. Data-breach class actions of this type typically seek remedies such as monetary damages, reimbursement for out-of-pocket losses, and enhanced data-security measures and credit-monitoring commitments. What, if anything, class members might ultimately receive would depend on how the litigation is resolved — none of which has happened yet.What Happens Next
EY will have an opportunity to respond, and the court will eventually address whether the case can proceed as a class action. Only if a class is certified and the case is later resolved through settlement or judgment would there be a notice-and-claim process. In the meantime, anyone who received an EY notice can enroll in the offered identity-monitoring service and take the usual post-breach precautions.For data-breach settlements that are open and actually claimable right now, see OCA's data breach settlements tracker.
Frequently Asked Questions
What happened in the EY data breach?
According to breach notices, an unauthorized party accessed a third-party IT platform EY uses to support tax-related work for clients and downloaded documents. EY has said the access occurred over a period in spring 2026 and that it detected the activity in late April 2026. The company began notifying affected individuals in July 2026.
What information may have been exposed?
State breach-notice filings indicate the exposed data may include Social Security numbers, financial account information, and credit or debit account details, along with tax-related documents. The exact data varies by individual; anyone who receives a notice should read it for the specifics that apply to them.
Is there a lawsuit, and what does it allege?
Yes. A proposed class action was filed in July 2026 in the U.S. District Court for the Southern District of New York alleging EY failed to adequately protect sensitive data and that affected individuals now face risks such as identity theft and fraud. These are unproven allegations; no class has been certified and EY has not been found liable.
Is there anything to claim right now?
No. This is at the lawsuit stage — there is no certified class, no settlement, and no claim form. If a settlement is reached in the future, eligible people would be notified about how to file a claim. EY has said it is offering complimentary identity monitoring and restoration services through Experian IdentityWorks to affected individuals.
What should I do if I received an EY breach notice?
Read the notice for the details specific to you and the enrollment information for any credit monitoring EY is offering. General steps people take after a breach include enrolling in offered monitoring, watching financial accounts, and considering a credit freeze or fraud alert. This page is informational and is not legal, financial, or tax advice.
Sources
• CFO Dive — EY hit with proposed class action over data breach• TechTimes — EY tax data stolen through third-party help-desk platform; four states notified
• Law360 — EY sued over breach targeting client tax, financial info
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
