Clients of Goldman Sachs’ wealth management division and UK-listed hedge fund Man Group are among the victims of a major data breach at Big Four accounting firm EY, according to notifications sent out in recent weeks. The disclosures widen the circle of victims of a hacking incident in March and April that the accounting firm first disclosed in July. It stemmed from a vulnerability in Checkmarx software, which had an impact on EY, several clients and many other organisations, EY said.
Several months after the attacks, EY has warned individuals who were clients of firms using EY’s tax services — including Goldman Sachs, Man Group and global real estate developer Tishman Speyer — that their personal and financial information had been compromised. Letters sent to affected clients at the end of September said that between March 28 and April 12 an “unauthorized third party” accessed the platform and downloaded documents. The letters said personal information affected included “name, address, tax identifier, email address, financial information”.
EY in July reported the incident to regulators in four US states: California, Texas, Massachusetts and Vermont. The same month, cybercriminal group Shiny Hunters claimed responsibility for the hack. Last month, Shiny Hunters said it had hacked the FBI, stealing thousands of records. A week later, Dutch police announced the arrest of one of the alleged leaders of the group.
Goldman told its wealth management clients last month that EY had hired an independent cyber security firm to confirm that systems involved were now secure. A Goldman Sachs spokesperson said: “Goldman Sachs’ systems were not affected by this incident, and client assets at Goldman Sachs were not impacted and remain safe.” A Man Group spokesperson said: “This incident was independent of Man Group’s systems, which were not compromised.”
Source: Financial Times Companies · Summarized by HeadlinesBriefing