ERNST & YOUNG LLP

Yes it was us. Now come talk to us. We have been trying to reach you. If you do not come talk to us within the given deadline, we fully and completely intend to release all the data and files. This is a final warning to reach out by 31 July 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 27 July 2026 | Warning: FINAL WARNING PAY OR LEAK

Ernst & Young LLP based in New York, New York, a other entity reported a data breach to the Texas Attorney General. The breach was discovered on 2026-04-23 and reported on 2026-07-17. 873 Texas residents were affected. 10,895 individuals affected in total. Types of information involved: Name of individual;Address;Social Security Number Information;Financial Information (e.g. account number, credit or debit card number);Other. Consumers were notified via U.S. Mail;Email.

Ernst & Young LLP reported a data breach to the Vermont Attorney General. The breach was reported to the AGO on 2026-07-16. The reporting organization type is Other Commercial. 13 Vermont residents were affected. Categories of data breached: Social Security Numbers, Financial Account Codes, Credit and Debit Account Info.

Ernst & Young LLP (EY) disclosed a data breach involving its third-party IT service management platform. Between March 28 and April 12, 2026, an unauthorized third party accessed the platform and downloaded documents containing client personal and financial information. EY detected the incident on April 23, 2026, engaged forensic investigators, notified law enforcement, and secured its systems. Affected individuals were offered 24 months of credit monitoring via Experian.

Ernst & Young, LLP notified the NH Attorney General of a data breach affecting 44 New Hampshire residents. Between March 28 and April 12, 2026, an unauthorized third party accessed a third-party IT service management platform used for tax services and downloaded documents containing SSNs, TINs, addresses, names, and financial account numbers. EY confirmed anomalous activity on April 23, 2026, contained the incident, and engaged a cybersecurity firm. Affected individuals are receiving 24 months of identity theft protection.

Ernst & Young LLP reported a data breach to the California Attorney General. The unauthorized access occurred between March 28, 2026, and April 23, 2026. The provided source document contains only the filing metadata and a link to the notice letter; the letter content is not included in the input, so specific details regarding data types, affected counts, and response actions could not be extracted.

Ernst & Young LLP (EY) disclosed a data breach affecting clients of its tax services. Between March 28 and April 12, 2026, an unauthorized third party accessed a third-party IT service management platform and downloaded client documents containing personal and financial information. EY discovered the activity on April 23, 2026, engaged forensic investigators, and notified law enforcement. The incident is contained. Affected individuals were offered 24 months of Experian Identity Works monitoring. No specific targeting was indicated.

Ernst & Young LLP (EY) notified Mitsubishi Electric Research Laboratories, Inc. (MERL) employees that on March 5, 2026, an EY team member inadvertently sent an email containing personal data (names, SSN, DOB, passport, nationality) to unintended recipients. EY confirmed deletion by recipients and offered two years of Experian IdentityWorks protection.

Ernst & Young LLP notified customers of a data breach involving personal data handled for Bank of America. On May 31, 2023, EY was informed by third-party supplier Progress Software Corporation of a security vulnerability in the MOVEit Transfer solution. The breach window is May 27-31, 2023. Affected data may include names, addresses, financial account information, credit/debit card numbers, and SSNs. EY engaged third-party security experts and is offering two years of identity theft protection via Experian.

Ernst & Young LLP (EY US) filed a supplemental notice with the New Hampshire Attorney General regarding a security incident involving a third-party service provider, Progress Software’s MOVEit Transfer solution. EY US was informed of the vulnerability on May 31, 2023. The supplemental notice identifies 629 affected New Hampshire residents, an increase from the initial 72 reported in August 2023. EY US engaged third-party security experts, secured systems, and offered credit monitoring via Experian. The investigation is now complete.

Ernst & Young LLP Canada reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-08-29. 2 Massachusetts residents were affected. The report records the breach type as electronic.

Ernst & Young LLP (EY) notified South Carolina residents of a data breach involving its third-party supplier, Progress Software Corporation. A security vulnerability in the supplier's MOVEit Transfer solution compromised personal data of EY clients. Data potentially included names, addresses, financial account info, credit/debit card numbers, SSNs, and government IDs. EY engaged third-party security experts and Bank of America (EY's client) is providing two years of identity theft protection via Experian.

Ernst & Young LLP Canada reported a data breach to the Indiana Attorney General. The breach occurred on 2023-05-27 and was reported on 2023-08-24. 1 Indiana residents were affected. 186 individuals affected in total.

Ernst & Young LLP reported a data breach to the Oregon Attorney General. The breach was reported on 2023-08-22. The breach occurred during 5/27/2023 - 5/31/2023. The breach was discovered on 5/31/2023. 168,714 individuals were affected. Notice was sent on 8/9/20238/22/2023.

Ernst & Young LLP notified the California Attorney General of a data breach involving personal data of Bank of America customers. On May 31, 2023, EY was informed by third-party supplier Progress Software Corporation of a security vulnerability in the MOVEit Transfer solution. The breach window is May 27-31, 2023. Affected data may include names, addresses, financial account information, credit/debit card numbers, and Social Security numbers. EY engaged third-party security experts and is offering two years of complimentary identity theft protection via Experian.

Ernst & Young LLP (EY US) notified the Delaware Attorney General on August 30, 2023, of a security incident involving its third-party supplier, Progress Software. A vulnerability in Progress Software's MOVEit Transfer file transfer solution compromised files containing personal data of 2,408 Delaware residents. Data potentially exposed includes names, addresses, financial account information, credit/debit card numbers, Social Security numbers, and government-issued IDs. EY US began mailing notifications on August 9, 2023, and offered 24 months of credit monitoring via Experian. Bank of America, an EY client, was not impacted.

Ernst & Young LLP reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-08-09. 7,320 Massachusetts residents were affected. The report records the breach type as electronic.

Ernst & Young LLP reported an external system breach (hacking) occurring between May 27 and May 31, 2023, discovered on May 31, 2023. The incident affected 30,210 individuals, including 100 Maine residents. Acquired data included names and driver's license numbers. Notification was sent electronically on August 9, 2023, and two years of identity theft protection services were provided by Experian.

Ernst & Young LLP reported a data breach to the Indiana Attorney General. The breach occurred on 2023-05-27 and was reported on 2023-08-09. 1,262 Indiana residents were affected. 30,210 individuals affected in total.

Ernst & Young LLP notified Montana residents of a data breach involving its third-party vendor, Progress Software Corporation. A vulnerability in the MOVEit Transfer solution compromised personal data including names, addresses, SSNs, and financial account numbers. EY launched an investigation and secured systems. Bank of America, an EY client, was not impacted. EY is offering two years of identity theft protection via Experian.

Ernst & Young LLP (EY US) notified the NH Attorney General of a security incident involving third-party supplier Progress Software's MOVEit Transfer solution. EY US was informed of the vulnerability on May 31, 2023. The incident compromised files containing personal data of 72 New Hampshire residents. EY US engaged third-party security experts, secured systems, and began mailing notifications on August 9, 2023, offering credit monitoring services.

Supplemental notice from King & Spalding LLP on behalf of Ernst & Young LLP (EY US) regarding a security incident involving Progress Software's MOVEit Transfer solution. The incident affected 3,571 Washington residents, up from an initial count of 1,129. Data exposed included names, addresses, financial account info, credit card numbers, SSNs, and government IDs. EY US engaged forensic experts, secured systems, and offered 24 months of credit monitoring. The investigation is now complete.

EY US - Home - Building a better working world

US FIRM OF ERNST AND YOUNG LLP filed a data-breach notice with the Illinois Attorney General during 2023 (case 23-535). The register records the breach as discovered on May 31, 2023. Additional entities named: MOVEIT. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.