If Ernst & Young has ever handled your taxes, or your bank's, this is worth the read. In mid-July 2026, EY began notifying people that some of their personal and financial information may have been stolen from an IT support ticket system.

What happened

Ernst & Young uses a third-party IT support platform, and some support tickets had client tax documents attached. EY spotted unusual activity on April 23, 2026, and found that an unauthorized party had been in the system between March 28 and April 12, 2026, downloading documents belonging to a number of clients (Security Affairs, BleepingComputer). Ernst & Young says it cut off the access and notified law enforcement, and reports no evidence yet of misuse.

What was exposed

Notification letters described by SecurityWeek list names, addresses, dates of birth, Social Security numbers, driver's license numbers, contact details, and financial data including card numbers and account information tied to tax filings (SecurityWeek). Ernst & Young has not said how many people were affected. Your letter, if you get one, will spell out what applied to you.

‍

A password you can change. A Social Security number and full tax profile you cannot, and that combination is exactly what a criminal needs to file a fake tax return, open credit, or craft a convincing scam (Cybernews). Stolen data also gets combined with what is already sold about you on data broker sites, which is the part you can actually shrink.

What to do now

1. Enroll in EY's offer. EY is providing 24 months of credit and identity monitoring through Experian IdentityWorks. Sign up by October 31, 2026 (Cybernews).
2. Freeze your credit at Equifax, Experian, and TransUnion. It is free and blocks new-account fraud (FTC).
3. Get an IRS Identity Protection PIN so no one can file a return in your name (IRS).
4. Be skeptical of calls, texts, and emails about your taxes or bank, even ones that quote real details. Verify through a number you look up yourself.
5. Cut your public footprint. Papaya Privacy scans 350+ data broker and people-search sites, removes your exposed information, and runs dark web monitoring so you hear early if your data surfaces. Less public data means the stolen Ernst & Young files are far less useful to anyone who has them.

If something does go wrong, Papaya Privacy bundles the full stack into one service: data removal, dark web monitoring, $1 million identity theft insurance, and hands-on restoration.

‍