Dive Brief:
- Ernst & Young is facing a proposed class action lawsuit alleging the Big Four accounting firm failed to protect sensitive data, including financial and tax information, exposed in a cybersecurity incident earlier this year.
- The lawsuit, filed Monday in the U.S. District Court for the Southern District of New York, asserts that affected individuals face risks such as identity theft and tax fraud. It seeks class certification as well as monetary relief for those impacted.
- “E&Y is a sophisticated organization with the resources to deploy robust cybersecurity protocols,” the complaint says, arguing that the firm “knew, or should have known” that such measures were necessary to protect sensitive data.
Dive Insight:
The legal action follows EY’s recent disclosure that an unauthorized third party accessed an IT service management platform used by the firm’s technology personnel.
The firm said it identified “anomalous activity” on the platform on April 23 and determined that an unauthorized party had accessed the system between March 28 and April 12, downloading documents associated with “a number” of EY clients.
The platform contained support tickets that could include attachments with client tax information, according to EY’s notification. The firm said it launched an investigation, worked with an independent cybersecurity firm and took steps to contain the incident and prevent further unauthorized access.
EY said in its notification that it was not aware of any misuse of affected information and that the firm had secured its systems. The firm offered eligible individuals 24 months of identity monitoring and restoration services through Experian.
The complaint alleges EY failed to meet its obligations to protect client information despite handling highly sensitive financial data as part of its tax and professional services businesses.
“Only E&Y was in the position to ensure that its systems and protocols were sufficient to protect the PII and financial and tax information that Plaintiff and Class Members had entrusted to it,” the lawsuit states.
The plaintiff, Illinois resident Markishi Wyatt, claims that her information was compromised in the breach.
Wyatt is seeking to represent all affected U.S. individuals. While the total number is not currently known, it is estimated to be in the tens or hundreds of thousands given EY’s global presence, according to the lawsuit.
EY did not immediately respond to a request for comment.
