EY breach exposed Goldman wealth clients while Goldman systems stayed secure

A breach at EY exposed information relating to clients of Goldman Sachs’ wealth-management business, according to separate reports by Bloomberg Law and the Financial Times. Goldman said its own systems were not affected. The bank also said client assets remained safe.

The incident involved an EY platform affected by a vulnerability in third-party software, the Financial Times reported. California’s attorney-general registry lists Ernst & Young LLP and records breach dates beginning on 28 March 2026. EY sent notices after reviewing the compromised information, while its investigation remained in its final stages at the time of the disclosures.

THIRD-PARTY EXPOSURE REACHED FINANCIAL CLIENTS

Bloomberg Law reported that Goldman data had been exposed and cited a person familiar with the matter. Goldman told the publication that it had remained in contact with EY and was supporting clients affected by the incident. The statement distinguished exposure at a service provider from a compromise of the bank’s own technology.

The Financial Times said notices identified names, addresses, tax identifiers, email addresses and financial information among the affected data categories. It also reported that Man Group and Tishman Speyer were among other EY clients connected to the incident. Those firms said their internal systems had not been compromised.

REMEDIATION AND CLIENT NOTICES CONTINUE

EY hired an independent cyber-security firm to validate the affected systems, according to the Financial Times. Goldman said its technology-risk team was reviewing that work and requiring objective evidence that remediation was effective. EY said the incident did not affect its broader enterprise systems or threaten continuing operations.

The immediate test is whether EY completes its investigation and whether additional clients or regulators disclose affected records. Goldman’s review of the remediation provides a separate control milestone. Any further assessment of impact will depend on client notices, regulatory filings and verified evidence of how the exposed information was used.