EY Data Breach Exposes Sensitive Client Information of Goldman Sachs, Man Group
Translated & summarized from Bizportal by baba
A data breach at EY exposed sensitive client information from Goldman Sachs and Man Group, occurring between March 28 and April 12 via an IT service platform. The compromised data includes personal and financial details, prompting EY to report to U.S. authorities and hire cybersecurity experts. The incident highlights vulnerabilities through external service providers, even for major financial institutions. The breach is linked to a Checkmarx software vulnerability and occurs as EY expands its AI usage.
The story in 6 lines · by baba
- EY data breach exposed sensitive client information of Goldman Sachs and Man Group.
- The intrusion occurred between March 28 and April 12 via an IT service management platform.
- Compromised data includes names, addresses, tax IDs, emails, and financial details.
- EY is cooperating with U.S. authorities and hired an independent cybersecurity firm.
- The breach highlights vulnerabilities through external service providers for large organizations.
- The incident is linked to a vulnerability in software from cybersecurity firm Checkmarx.
A significant data breach at EY, one of the world's largest accounting firms, has exposed sensitive financial and personal information of clients, including those of Goldman Sachs' wealth management division, the hedge fund Man Group, and investors linked to the Tishman Speyer real estate group. The intrusion occurred between March 28 and April 12, when an external party gained access to an IT service management platform used by EY teams. This platform sometimes contained client documents related to tax work. The breach was detected on April 23, triggering an investigation into the extent of the exposure. The compromised data includes names, addresses, tax identification numbers, email addresses, and financial details. EY has reported the incident to federal authorities and regulators in several U.S. states and hired an independent cybersecurity firm to assess the situation. Goldman Sachs and Man Group stated that their internal systems remained secure and the incident was confined to the external service provider, assuring that client assets at Goldman were protected. This incident highlights how large organizations, despite investing heavily in cybersecurity, can be vulnerable through their external service providers, such as accounting firms, law offices, or software platforms. The Big 4 accounting firms, which collectively employ over 1.5 million people and generate over $220 billion annually, manage vast amounts of sensitive data beyond financial statements, including details on securities, investments, and business transactions. The breach is linked to a vulnerability in software from Checkmarx, a company specializing in securing software development processes, which had previously reported a supply chain incident affecting some of its development components. The incident occurs as EY is expanding its use of artificial intelligence, deploying agent-based systems for its audit operations, which increases system connectivity and potential vulnerabilities. In Israel, EY is a dominant firm, auditing a large portion of the country's major public companies, competing with Deloitte, KPMG, and PwC for significant audit, consulting, and technology contracts. The breach underscores a growing expectation for accounting firms to maintain data security standards comparable to financial institutions.