Attackers spent two weeks inside a third-party support platform used by Ernst & Young and downloaded client tax documents. The lesson is about where sensitive files actually end up.
On 17 July, Ernst & Young began notifying clients that an unauthorised party had downloaded documents from a third-party platform the firm uses to handle IT support requests. The access ran from 28 March to 12 April 2026. EY identified anomalous activity on the platform on 23 April. The material taken was support tickets, and support tickets raised around a tax practice carry attachments.
According to the notification, the exposed information includes names, addresses, Social Security numbers, account numbers, payment card numbers and other data used to prepare tax filings. EY has not named the compromised platform, has not said how many people were affected, and states it is not aware of any misuse of the information. No extortion group has claimed the intrusion. Affected clients are being offered 24 months of identity monitoring through Experian, with enrolment open until 31 October 2026.
The breached system exists to route and track support requests. Nobody procures a service management tool as a repository for tax returns, and yet that is a fair description of what it held. The path there is mundane. A client cannot get a document to upload, or a preparer needs a file checked, and the quickest way to resolve the ticket is to attach the document to it. The file now lives in a system selected for workflow convenience, stored in whatever form that system stores attachments, under whatever retention policy it happens to apply.
This is the ordinary shape of the problem. Sensitive documents accumulate in the systems that are easiest to reach, and those systems are rarely the ones subjected to the most scrutiny.
The published timeline is worth reading closely. The intruder had access for roughly two weeks. Detection came eleven days after that access ended. Client notification followed about three months later, on 17 July. Each of those intervals has a reasonable explanation; forensic investigation and legal review genuinely take time. The relevant point is that by the time any of it began, the documents were already copied.
Controls that depend on noticing an intrusion operate on a slower clock than the exfiltration they are meant to catch. They remain necessary. They are a poor sole defence for data that stays sensitive for decades, which is exactly what a Social Security number or a completed tax filing is.
A single sensitive document rarely stays in one place. It is emailed, attached to a ticket, saved to a shared drive, downloaded to a laptop, and forwarded to a colleague who was not on the original thread. Every copy is readable, and every copy inherits the security posture of wherever it landed rather than the posture of the system it started in.
Breach notifications tend to describe the weakest link in that chain. An organisation can hold client files in a hardened, audited, well-monitored system and still lose them from the ticketing tool nobody classified as sensitive.
The most sensitive files in an organisation are often sitting in the system nobody classified as sensitive.
No file transfer product stops a person from attaching a document to a support ticket, and it would be dishonest to suggest otherwise. What the transfer channel does determine is whether it creates yet another readable copy on its way through.
SpaceBox Lite encrypts each file on the sender's device before it moves. The file is sealed with AES-256-GCM and the key is wrapped to the recipient's public key using post-quantum ML-KEM-768 (NIST FIPS 203). Private keys stay on the device, and our servers hold ciphertext only. A breach of that storage yields bytes nobody can read, including us. Senders need no account and provide no personal data, so there is no sender database to lose in the first place. Post-quantum key exchange is not unique to SpaceBox, and a growing number of tools now ship it; the part that matters here is where the keys live.
That narrows the problem rather than solving it outright. Once a recipient decrypts a file and moves it into another system, the guarantees of the transfer no longer travel with it. The practical value is in shrinking the number of systems that ever hold a readable version, and in making the storage layer worthless to whoever eventually breaks into it.
EY's clients did nothing unusual. They sent their accountants the documents their accountants asked for. The exposure came from what happened to those documents afterwards, in a system they never saw and could not evaluate. That is the part worth designing around.