The most sensitive files in finance do not always sit inside a bank. They sit in the systems of the firms that serve the bank — the accountants, the tax advisers and the support platforms that move documents between them. That is the uncomfortable lesson of the breach at EY, in which an intruder spent days inside a platform supporting the firm’s tax work and downloaded files that included information about clients of Goldman Sachs’ wealth management business.
According to the disclosures that followed, the unauthorised access ran for more than two weeks before it ended, and EY detected the suspicious activity eleven days after the last known access. By the time anyone noticed, the downloading had already happened. It is a pattern our business coverage returns to often: the break-in is rarely the dramatic part. The quiet gap between access and detection is where the damage is done.
What was taken, and whose systems were actually breached
The exposed material reportedly included names, addresses, email addresses, tax identification numbers and financial details, along with tax-filing documents that had been attached to internal support tickets. That detail matters. The files were not pried out of Goldman Sachs’ own vault; they were sitting in a workflow tool, the kind of unglamorous software that staff use to ask IT for help, where attachments accumulate and are easily forgotten.
Both Goldman Sachs and Man Group, whose clients were also named in later notices, have stressed that their own systems were not compromised and that client assets were not touched. That distinction is real, but it is cold comfort to the individuals whose tax documents were copied. From a client’s point of view, the chain of custody broke at a firm they may never have dealt with directly — they chose a wealth manager, not the wealth manager’s accountant’s helpdesk software.
Why support platforms are such attractive targets
Security budgets concentrate on trading systems, payment rails and customer portals. Support queues, by contrast, are treated as plumbing. Yet a ticketing platform can hold an extraordinary cross-section of an organisation: password reset requests, contracts, onboarding documents and, in this case, tax files containing some of the most identity-rich data a person owns. Attackers understand this asymmetry, which is why vendor and supply-chain intrusions have become the reliable route into well-defended companies, a risk the Cybersecurity and Infrastructure Security Agency has warned about for years.
The eleven-day detection gap is the second lesson. Modern intrusions are usually discovered quickly or not for months; eleven days suggests monitoring existed but was not watching this particular system closely. Tools that sit outside the core network often sit outside the alerting rules as well, even though the data inside them is anything but peripheral.
What happens to the people whose files were copied
For affected clients, the practical risks are identity theft, targeted phishing and tax fraud — a stolen tax identification number paired with a real address and financial details is exactly what a fraudster needs to file a false return or open accounts. EY has offered identity monitoring, and the standard advice applies with unusual force here: freeze credit where possible, watch accounts for unfamiliar activity and treat any unsolicited message that references real financial details with deep suspicion. The Federal Trade Commission’s identity theft guidance lays out the steps in plain language.
Goldman Sachs, for its part, told clients it had demanded objective evidence that the compromised systems had been secured, including third-party verification. That is the right instinct, and it points to where this story is really heading: large financial firms are going to have to audit their vendors’ vendors, demand proof rather than assurances, and treat every support tool that touches client documents as part of the vault — because, as this breach showed, attackers already do. More reporting on finance and security is on our homepage.
