For 11 days, intruders had access to systems at EY, one of the world’s largest professional services firms, and in that window they reached data belonging to some of the wealthiest clients in finance: customers of Goldman Sachs’ wealth management business. The breach, disclosed quietly rather than announced loudly, is now a reference case for how risk travels through the vendors that even the most security-conscious firms must trust.
What happened, and when
According to the disclosures that followed, unauthorised access to an EY environment persisted for 11 days before it was contained. Data connected to Goldman Sachs wealth clients was exposed in the process. Wealth management records are among the most sensitive in finance: names, account details and financial information belonging to high-net-worth individuals, exactly the material that fuels targeted fraud, extortion and highly personalised phishing. Neither firm’s clients had chosen EY as their bank; the exposure arrived through the supply chain, which is precisely what makes the case instructive. Our Business reporting follows the financial sector’s security reckoning closely.
Third-party risk is the risk
Modern financial firms outsource relentlessly: audit, tax, technology, data processing. Each vendor becomes a doorway, and attackers know a service provider’s defences may be softer than a global bank’s. Regulators have been saying this for years. The US Securities and Exchange Commission has tightened disclosure and oversight expectations, while the Federal Trade Commission publishes the baseline safeguards expected of firms holding consumer financial data. An 11-day dwell time, the gap between intrusion and detection, is the metric security teams will study most: breaches are rarely prevented perfectly, but days of undetected access is where damage multiplies.
Lessons for financial firms
Several lessons recur whenever post-incident analyses of vendor breaches are published. First, inventory: firms must know exactly which vendors hold which client data, in what form, and for how long, because data retained unnecessarily is exposure without benefit. Second, contractual security requirements mean little without verification, through audits, evidence of monitoring and tested incident-notification timelines measured in hours, not weeks. Third, detection speed is a board-level metric; continuous monitoring and rehearsed response plans are what turn an 11-day intrusion into an 11-hour one.
Finally, communication matters. Affected wealth clients expect prompt, specific information about what was taken and what protection follows, including credit monitoring and dedicated support, not a generic statement weeks later.
The wider pattern
The EY and Goldman episode joins a lengthening list of incidents in which the named victim and the breached company are different organisations. For clients, the practical response is unglamorous vigilance: unique passwords, hardware-backed authentication where offered, scepticism toward urgent financial requests, and prompt action on any notification letter. For the industry, the message is sharper. Your security perimeter now includes every firm you hire, and the attackers have already done that maths. More finance and security coverage is available on our homepage.
Why wealth clients are singled out
Security researchers note that wealthy individuals occupy a uniquely exposed position. Their financial lives involve many intermediaries, advisers, accountants, family offices, service firms, each holding fragments of sensitive data, and their public profiles make personalised deception easier to craft. A breach at any one intermediary can hand criminals the raw material for convincing impersonation: real balances, real relationships, real transaction patterns. That is why notification after a vendor breach should trigger concrete steps for this group in particular, transaction alerts, verbal passwords with advisers, out-of-band confirmation for any movement of funds, and a standing assumption that email is compromised until proven otherwise.
Advisers serving this clientele increasingly treat cyber briefings as part of onboarding, alongside tax and estate planning. After incidents like this one, it is easy to see why: the weakest link is rarely the bank’s vault. It is the long chain of trusted firms around it, and every link now has to hold.
