How Ernst & Young's Third-Party Hack Exposed Customer Data

Michael Miller · 2026-07-17

Ernst & Young, one of the Big Four accounting firms, is notifying customers of a data breach after hackers compromised a third-party support ticket system used by its IT team. The breach, which occurred earlier this year, exposed sensitive customer information, raising serious questions about supply chain security in the professional services industry. Let's break down what happened, why it matters, and how you can protect your business from similar risks. ### What Happened in the Ernst & Young Breach? The breach involved a third-party support ticket system that Ernst & Young used to manage IT requests. Attackers gained access to the system and stole data from support tickets, which often contain sensitive details about customer systems, configurations, and even credentials. While Ernst & Young has not disclosed the exact number of affected customers, the firm is contacting those impacted and offering credit monitoring services. This is a classic supply chain attack, where hackers target a vendor or partner to reach a larger organization. In this case, the third-party system was the weak link, not Ernst & Young's core network. But customers still suffered because their data was stored in a less secure environment. ### Why Third-Party Risks Are Growing Third-party breaches are becoming more common as companies outsource IT, customer support, and other services. According to a recent Ponemon Institute study, 59% of organizations experienced a data breach caused by a third party in the past year. The average cost? Over $7.5 million per incident. That's a lot of money, especially when you consider that many of these breaches could have been prevented with better vendor management. For Ernst & Young, the breach highlights the challenge of maintaining security across multiple vendors. With thousands of suppliers and partners, even a single weak link can expose millions of records. The firm's response—prompt notification and credit monitoring—is standard, but it doesn't address the root cause: the need for stricter vendor security standards. ### How to Protect Your Business from Similar Breaches If you're a business relying on third-party vendors, here are some steps you can take to reduce your risk: - **Conduct thorough vendor assessments** before signing contracts. Check their security certifications, audit reports, and incident response plans. - **Limit data sharing** with third parties. Only provide the minimum data necessary for them to do their job. - **Require multi-factor authentication** for all vendor access to your systems or data. - **Monitor vendor activity** using tools that track unusual logins or data transfers. - **Have a breach response plan** that includes vendor-related incidents. Know who to contact and what steps to take if data is exposed. ### The Bigger Picture: Supply Chain Security in 2025 This breach is a reminder that no company is immune to supply chain attacks. Even the most secure organizations can be compromised through their vendors. The key is to build a security culture that extends beyond your own walls. This means regularly reviewing vendor contracts, conducting penetration tests on third-party systems, and staying informed about emerging threats. For professionals in the antidetect browser space, this story is especially relevant. Antidetect browsers are designed to protect user identity and data, but they're only as secure as the systems they connect to. If you're using a third-party service to manage your antidetect browser setup, make sure that service follows the same security standards you do. ### What This Means for You If you're a customer of Ernst & Young, check your email for breach notifications. If you haven't received one but think you might be affected, contact the firm directly. For everyone else, use this incident as a wake-up call to audit your own vendor relationships. A little due diligence now can save you from a lot of headaches later. Remember, data breaches are not just a tech problem—they're a business problem. The cost of a breach can include lost customers, legal fees, and reputational damage that lasts for years. By taking proactive steps to secure your supply chain, you can protect your business and your customers.