The clients of Goldman Sachs’s wealth management arm did everything right. They chose one of the most security-conscious names in finance. What they could not control was the perimeter of the firms their bank works with — and a breach at accounting giant EY has now exposed their data through exactly that side door. Security reporters, including the trackers at Krebs on Security, have documented the pattern for years: the professional-services firm, not the bank, is increasingly where finance gets breached.
According to the disclosures, attackers accessed files at EY connected to services performed for Goldman’s wealth business, exposing client information. Our news coverage has followed the notifications as affected clients have been informed — and as the incident becomes a case study in third-party risk.
Why Wealth Clients Are the Prize
Wealth management data is among the most valuable categories an attacker can steal. It combines identity documents, account details, contact information for family members and staff, and insight into a client’s financial life — the raw material for highly convincing fraud. A phishing email referencing a real adviser, a real account and a real transaction history is not spam; it is a weapon, and it retains its value for years.
That value explains the targeting. Criminal groups have learned that the advisory ecosystem — accountants, custodians, administrators, law firms — holds bank-grade data with, historically, less-than-bank-grade defences. EY, which describes its own security posture on its corporate site, is a sophisticated firm; that a firm of its scale can be breached is precisely the point about the threat level.
The Vendor-Risk Problem
Modern wealth management runs on an ecosystem. Every client relationship touches custodians, tax platforms, transfer agents and professional firms, each holding fragments of the same financial life, each a potential doorway. The traditional defence — annual due-diligence questionnaires — is giving way to continuous monitoring, contractual audit rights and regulator pressure on financial firms to treat vendor security as their own.
Regulators on both sides of the Atlantic have been explicit that outsourcing does not outsource accountability. The bank whose clients are exposed owns the client relationship and, increasingly, the regulatory consequences — even when the compromised server belonged to somebody else.
What Affected Clients Should Do
The standard advice carries unusual weight for this population. Freeze credit where available; treat any communication asking for money movement as hostile until verified through a known number; enable hardware-backed authentication; and assume that personal details — names of children, staff, advisers — may now be in circulation for social engineering. Private banks are also briefing clients directly, and family offices are re-running their own vendor reviews in the incident’s wake.
The Notification Dilemma
Incidents like this expose a recurring tension in breach response: speed versus completeness. Firms are pressed to notify affected clients quickly, yet early notifications routinely understate scope, and each revision erodes the trust the notification was meant to preserve. Wealth clients, advised by their own lawyers and security consultants, increasingly treat the first letter as an opening statement rather than the facts.
Practitioners say the better model is staged candour — say what is known, say what is not yet known, commit to dates for updates, and keep them. In a business where the product is trust, the handling of the breach becomes the evidence clients use to judge whether that trust was ever warranted. Several firms in the advisory ecosystem are understood to be rewriting their incident playbooks on exactly that principle since this breach became public.
The deeper story is structural. Finance spent two decades hardening its own walls while its work — and its data — migrated to partners. The EY incident will not be the last breach announced by a firm whose name is not on the client’s statements. The industry’s security perimeter is now the sum of its vendors’ perimeters, and it will be managed that way, or breached that way. More on the fallout in our news section.
