EY Tax-Platform Breach Exposed Goldman Sachs and Man Group Client Data

EY said unauthorized access from March 28 to April 12, 2026, exposed tax and financial data of Goldman Sachs and Man Group clients; one report also named Tishman Speyer.

Ernst & Young warned that an unauthorized party accessed a tax-services support platform between March 28 and April 12, 2026, and downloaded client documents containing names, addresses, tax identification numbers, email addresses, and financial details. Both reports tie the files to Goldman Sachs wealth-management clients and UK-listed hedge fund Man Group; GBHackers also links them to Tishman Speyer investors, which Cyber Security News does not mention. The firms said their own systems were not compromised, and EY said its broader systems were not breached. EY detected the activity on April 23 and linked it to a Checkmarx vulnerability without naming a CVE. Sources differ on notifications: Cyber Security News lists regulators in California, Texas, Massachusetts, and Vermont and says EY is offering credit monitoring, while GBHackers specifies a July 15 notice to California and reports an unconfirmed ShinyHunters claim of responsibility.

• Unauthorized access to EY’s tax-services support platform ran from March 28 to April 12, 2026; EY detected suspicious activity on April 23.
• Downloaded client documents included names, addresses, tax identification numbers, email addresses, and financial details.
• Both reports link the data to Goldman Sachs wealth-management clients and UK-listed hedge fund Man Group; only GBHackers also names Tishman Speyer investors.
• Goldman Sachs and Man Group said their own systems were not compromised; EY said its broader systems were not breached.
• EY attributed the incident to a Checkmarx vulnerability but named no CVE.
• Cyber Security News said EY notified regulators in California, Texas, Massachusetts, and Vermont and is offering credit monitoring; GBHackers specified a California notice on July 15.
• GBHackers reported that ShinyHunters claimed responsibility; that claim has not been independently confirmed.