Consulting giant EY is still cleaning up after a cybersecurity incident that lasted 11 days and quietly reached far beyond its own walls. During the breach, attackers gained access to systems that held data belonging to wealth management clients of Goldman Sachs, one of EY’s most prominent clients, forcing both firms into an unwelcome spotlight over how third-party providers protect sensitive financial information.
What Happened, Day by Day
According to the disclosure timeline, intruders entered EY’s environment and remained undetected for 11 days. The incident began like so many corporate breaches: an initial foothold, lateral movement through internal systems, and eventual access to data repositories that included client information. EY has said it contained the intrusion and engaged forensic specialists, but the window was long enough for the attackers to reach material that should never have been exposed.
Goldman Sachs wealth clients were affected because EY handles work that touches their data, the exact kind of trusted-advisor relationship that adversaries prize. For the clients themselves, the exposure is doubly unsettling: they chose a bank with formidable security, only to have their information reached through a different firm’s systems.
Why the Quiet Part Matters
Breaches that surface months after discovery raise the same question every time: when did the affected people learn, and was it fast enough? Regulators increasingly judge firms on notification speed, not just on the quality of their defences. An 11-day dwell time is not extraordinary by industry standards, but it is well within the window that attackers need to map a network and locate high-value data.
The U.S. Securities and Exchange Commission has tightened expectations around incident disclosure for public companies, and even where a regulator’s letter does not apply, clients and counterparties expect candour. Transparency after a breach is a commercial asset; concealment, or the appearance of it, turns one incident into two stories.
Lessons for Financial Firms
The first lesson is about third-party risk. Banks invest heavily in their own perimeters while sharing crown-jewel data with auditors, consultants, law firms and cloud vendors. Each of those relationships is a potential bridge for attackers, and the EY episode is a reminder that vendor security reviews cannot be paperwork exercises.
The second is about dwell time. Detection speed decides how much damage an intrusion can do. Firms that have invested in managed detection, network segmentation and exercised incident-response plans tend to cut intrusions short; those that have not learn the cost the hard way. Readers following our blog coverage of financial markets will recognise the pattern from earlier third-party breaches.
What Clients Should Do Now
Affected individuals should follow the usual post-breach playbook: enrol in any credit monitoring offered, place fraud alerts or credit freezes, watch accounts for unfamiliar activity, and treat unsolicited messages referencing the incident with suspicion, since breached data often feeds targeted phishing. Wealth clients, who may be identifiable by name and affluence, deserve particular vigilance.
How Firms Are Responding
In the aftermath, professional services firms are accelerating investments that board members once considered optional. Multi-factor authentication is being enforced for every remote login, privileged accounts are being placed under continuous monitoring, and firms are running tabletop exercises in which executives rehearse the first 48 hours of a breach under time pressure. The exercises often expose the same weakness the EY case highlights: nobody is quite sure who owns the client notification, legal counsel, the regulator and the press office, so precious days are lost to coordination.
Equally important are the safety nets that firms usually buy quietly. Cyber insurance underwriters are now asking harder questions about vendor risk and expected detection time, and are pricing policies accordingly. Clients, too, are putting security clauses with measurable requirements directly into engagement letters, including rights to audit and deadlines for notification that are far shorter than what the law alone demands.
The Bigger Picture
The EY incident will be cited in boardrooms for years as evidence that cybersecurity is a supply-chain problem. Clients of every large firm should expect their providers to answer three questions: how do you segment our data, how fast do you detect intrusions, and when do you tell us? Follow our homepage for updates as the investigation and the regulatory response develop.