EY has begun notifying clients this month that an unauthorized third party accessed a third-party support ticket system used by its IT staff, potentially exposing personal and financial information contained in — or used to prepare — client tax filings. The intruder allegedly had access between March 28 and April 12, downloading multiple documents belonging to a number of clients. The firm notified affected individuals via a filing with the California Department of Justice and reported the incident to federal law enforcement. EY has not disclosed how many clients were impacted or which third-party provider was involved. Class action firm Edelson Lechtzin has opened an investigation into potential claims.

Support ticket systems are particularly attractive to attackers because they routinely contain screenshots, uploaded documents, credentials, and configuration details shared during troubleshooting — a rich secondary source of sensitive data outside the primary systems it references. The two-week dwell time between initial access and detection is also representative of the industry norm: without visibility into the SaaS and vendor platforms where the data lives, intrusions often persist long enough for meaningful exfiltration before anyone notices.

Reducing this exposure requires visibility that extends across third-party platforms, SaaS integrations, and data flows leaving the enterprise — not just the perimeter. Effective controls include behavioral analytics on API and integration activity, baselining of document downloads and data movement between systems and vendors, encryption and tokenization so exported data is unusable if stolen, and packet-level capture with long retention for forensic scoping. Unified platforms like NIKSUN give professional services firms the cross-domain context needed to detect unauthorized access to client data in progress, quantify scope for breach notification, and produce the evidence regulators and plaintiffs demand. Read more about this story on our LinkedIn page