MeridianMeridian

EY Confirms Data Breach Exposing Goldman Sachs and Man Group Client Details via Checkmarx Vulnerability

EY has confirmed a data breach involving client documents accessed through a third-party technology services management platform used to support its tax operations. The unauthorized access occurred via a vulnerability in Checkmarx software and lasted from March 28 to April 12, with detection only on April 23. Exposed information included names, addresses, tax identification numbers, email addresses, and financial details belonging to clients in Goldman Sachs wealth management and the Man Group investment fund. Neither Goldman Sachs nor Man Group systems were compromised, confirming the exposure originated solely from EY's environment. The leaked materials consisted of attachments from support tickets rather than core system data. EY has engaged independent security firms, notified regulators in California, Texas, Massachusetts, and Vermont, and offered credit monitoring to affected individuals.

BoletimSecTranslated from Portuguese

Read at source

EY has confirmed a significant data breach in which client documents were accessed and downloaded by an unauthorized party. The files originated from a technology services management platform contracted by EY to support its tax operations division.

The affected clients include individuals from the wealth management division of Goldman Sachs and entities connected to the Man Group, a listed investment fund based in the United Kingdom. Both organizations confirmed that their own systems remained uncompromised, with the exposure occurring exclusively through the EY side.

The leaked materials consisted of attachments from support tickets rather than data from the primary system. This incident highlights how auxiliary support channels can accumulate sensitive client information without receiving equivalent security treatment. Exposed details include names, addresses, tax identification numbers, email addresses, and financial information, enabling the construction of complete personal profiles.

Unauthorized access was achieved through a vulnerability in the Checkmarx software. The intrusion persisted from March 28 to April 12, with suspicious activity detected only on April 23. EY has since engaged independent security firms to assess its systems, notified regulators in California, Texas, Massachusetts, and Vermont, and offered credit monitoring services to impacted individuals.

CheckmarxGoldman SachsMan
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Data Breaches & Leaks

Yandex Restores Access to 96% of Yandex Disk Data After Data Center Attacks
Data Breaches & Leaks

Yandex Restores Access to 96% of Yandex Disk Data After Data Center Attacks

Yandex has recovered access to 96 percent of user data stored on Yandex Disk following attacks that damaged its data centers. Files including documents, photographs, and videos are once again available for opening, downloading, and sharing for the majority of users. The company continues to redistribute Disk capacity across independent external sites to improve overall resilience. Basic operations such as uploading, downloading, and synchronization are now functional, yet the web version still imposes restrictions on bulk actions like downloading entire folders or multiple files at once. Users are advised to rely on the desktop client or API for these tasks during the remaining recovery phase. Yandex publishes ongoing updates on the official Yandex 360 service status page and has not provided an exact date for full restoration.

AntiMalwareOct 28, 2026Translated from Russian

k0t Operators Breach Corporate Firewalls and VPNs Exposing Over 70,000 Credentials
Data Breaches & Leaks

k0t Operators Breach Corporate Firewalls and VPNs Exposing Over 70,000 Credentials

Group-IB and NyxLab detailed a campaign by the operator k0t targeting exposed firewalls and VPN portals. The operation collected more than 70,000 credentials from network devices and LDAP directory extractions across 84 compromised appliances. Initial access relied on CVE-2025-64446 directory traversal in FortiWeb, CVE-2026-0257 authentication bypass in Palo Alto GlobalProtect, and password brute-forcing against FortiGate devices. Attackers then leveraged CVE-2019-6693 to decrypt FortiOS configuration secrets and chained the noPac technique to reach domain administrator privileges. Persistence was achieved through MeshCentral, AdaptixC2, Atera, AnyDesk, and ngrok, while Rclone handled data exfiltration to cloud storage. Victims appeared on the Qilin and The Gentlemen leak sites, suggesting the operators likely act as initial-access brokers rather than direct ransomware affiliates.

BoletimSecOct 26, 2026Translated from Portuguese

OpenCode Reports Possible Exposure of Third-Party API Keys After Legacy System Breach
Data Breaches & Leaks

OpenCode Reports Possible Exposure of Third-Party API Keys After Legacy System Breach

OpenCode disclosed that an attacker accessed a legacy system on October 16, potentially exposing API keys from external providers that users had stored in the Console. The incident affected only 1.4 percent of Console users, and the targeted system was already undergoing decommissioning. The company described the exposure as possible rather than confirmed and provided no details on the attack vector, duration, or number of keys involved. Some affected users reported unauthorized charges on their provider accounts. OpenCode stated that the incident was limited to keys stored in the Console and did not impact keys saved locally in its command-line or desktop applications. The firm notified impacted users by email on October 17 and is working with Anthropic, OpenAI, and Google. It recommended revoking and rotating exposed keys directly with each provider.

BoletimSecOct 20, 2026Translated from Portuguese