HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Government IDIdentity (basic)Financial accountFinancialMediumContained

ERNST & YOUNG LLP

bd_29b6b4794ab7836c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 23, 2026

Filed

Jul 15, 2026

To disclose

12 weeks

Affected

44state residents only

Linked

7 filings

Confidence

66%

Full breach record for ERNST & YOUNG LLP →5 incidents on file

Ernst & Young, LLP notified the NH Attorney General of a data breach affecting 44 New Hampshire residents. Between March 28 and April 12, 2026, an unauthorized third party accessed a third-party IT service management platform used for tax services and downloaded documents containing SSNs, TINs, addresses, names, and financial account numbers. EY confirmed anomalous activity on April 23, 2026, contained the incident, and engaged a cybersecurity firm. Affected individuals are receiving 24 months of identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 26 days

discovery → filing · 12 weeks / 83 days

Mar 28, 2026

Begins

Apr 23, 2026

Discovered

Jul 15, 2026

Filed

vs. sector median

7 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteshinyhuntersbd_dd03905a2bb4d77f2026-07-27 · +12dVerified by operator

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_0d2e166fcb18c8cf2026-07-15Verified
California State AGbd_42c010b106cfcaeb2026-07-15Verified
Vermont State AGbd_e6037bfd1b169e8c2026-07-16 · +1dVerified
Nebraska State AGbd_f6da314010d1a4dd2026-07-14 · +1dCandidate

Show 1 more filing ↓up to 2d gap

Texas State AGbd_fd00b5fb305eb1e22026-07-17 · +2dVerified

Name: Ernst & Young, LLP
norm: ernst young

Name: ERNST & YOUNG LLP
norm: ernst young
Domain: ey.com
Industry: Professional Servicesllm

Discovered: Apr 23, 2026
Breach occurred: Mar 28, 2026 – Apr 12, 2026
Undetected for: 26 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 13, 2026
Affected individuals: 44state-resident count only
Data types: Government IDIdentity (basic)Financial accountFinancial
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Third party: via third-party information technology service management platform
Initial access: trusted_relationship

During the incident: Initiated its response procedure to determine the nature and scope of the incident, contain it, and begin remediation and recovery efforts
Worked with an independent cybersecurity firm to investigate the incident
Confirmed that the unauthorized access has been stopped
Providing notice to each affected individual
Providing all individuals impacted with twenty-four (24) months of free identity-theft protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(83 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Nebraska State AGJul 14 · first

Massachusetts State AG+1d

California State AG+1d

New Hampshire State AG+1d · this page

Vermont State AG+2d

Texas State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ernst-young-20260715.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 15, 2026
Raw hash: ed00e2e9eb215c1d947149d0a32fd9adc0712b907101db12497ae7d68fc29d84

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityErnst & Young, LLP

Victim entityERNST & YOUNG LLP

Incidentdiscovered Apr 23, 2026

Stated responseInitiated its response procedure to determine the nature and scope of the incident, contain it, and begin remediation and recovery efforts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov