AccidentalProfessional ServicesTechnologyProfessional ServicesMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDPIIMediumContained

Mitsubishi Electric Research Laboratories, Inc.

bd_bb8ca62a82d20c98 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 5, 2026

Filed

May 18, 2026

To disclose

8 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Mitsubishi Electric Research Laboratories, Inc. →

Ernst & Young LLP (EY) notified Mitsubishi Electric Research Laboratories, Inc. (MERL) employees that on March 5, 2026, an EY team member inadvertently sent an email containing personal data (names, SSN, DOB, passport, nationality) to unintended recipients. EY confirmed deletion by recipients and offered two years of Experian IdentityWorks protection.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d8 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 11 weeks / 74 days

Mar 5, 2026

Begins

Mar 5, 2026

Discovered

May 18, 2026

Filed

vs. sector median

11 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: ERNST & YOUNG LLP
norm: ernst young
Domain: ey.com

Name: Mitsubishi Electric Research Laboratories, Inc.
norm: mitsubishi electric research laboratories
Industry: Professional ServicesllmTechnologyllm

Discovered: Mar 5, 2026
Breach occurred: Mar 5, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 15, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDPII
Data elements: Social Security numberDate of birth
Attack vector: Unknown
MITRE ATT&CK: T1535 Unused/Unsupported Cloud Storage
Threat actor: Internal

During the incident: Informing affected individuals
Making available a complementary two-year membership in an identity theft protection service provided by Experian IdentityWorks
Recommending monitoring of credit cards and bank accounts
Recommending enrollment in the complimentary Credit Monitoring Service
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-794-ernst-young-llp/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 18, 2026
Raw hash: 0a62f2b9067f8c151cf7ec200aa66cd6ced3a28c898aa4f4a896bd44d80dfdf1

Reporting entityERNST & YOUNG LLP

Victim entityMitsubishi Electric Research Laboratories, Inc.

Incidentdiscovered Mar 5, 2026

Stated responseInforming affected individuals

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov