At a Glance

  • Ernst & Young is facing a proposed class action lawsuit alleging that the Big Four accounting firm failed to protect sensitive data, including financial and tax information, exposed in a cybersecurity incident earlier this year.
  • The lawsuit, filed Monday in the U.S. District Court for the Southern District of New York, claims affected individuals face risks such as identity theft and tax fraud, and seeks class certification and monetary damages for those affected.
  • The complaint states, "EY is a mature organization with the resources to deploy robust cybersecurity protocols," and argues the firm "knew or should have known" that such measures were necessary to protect sensitive data.

In-Depth Analysis

The legal action followsEY's recent disclosurethat an unauthorized third party accessed the IT service management platform used by the firm's technical staff.

EY stated it discovered "unusual activity" on the platform on April 23 and determined that an unauthorized party accessed the system between March 28 and April 12, downloading documents related to "several" EY clients.

According to EY's notice, the platform contained support tickets that may have had attachments with client tax information. EY said it launched an investigation, worked with an independent cybersecurity firm, and took steps to contain the incident and prevent further unauthorized access.

In its notice, EY said it found no indication of misuse of the affected information and that the firm has secured its systems. EY is offering 24 months of identity monitoring and restoration services through Experian to eligible individuals.

The complaint accuses EY of failing to fulfill its obligations to protect client information, despite handling highly sensitive financial data in its tax and professional services businesses.

The lawsuit states, "Only EY could ensure that its systems and protocols were sufficient to protect the personally identifiable information (PII) and financial and tax information entrusted to it by the plaintiff and class members."

The plaintiff, Illinois resident Markishi Wyatt, claims her information was compromised in the breach.

Wyatt seeks to represent all affected U.S. individuals. The lawsuit states that while the total number is not yet clear, it is estimated to be in the tens of thousands to hundreds of thousands, given EY's global operations.

EY did not immediately respond to a request for comment.