Ernst & Young LLP Data Breach Notice (Massachusetts Attorney General)

The Social Security numbers of 480 Massachusetts residents are now in the hands of an unknown party following a data breach at Ernst & Young LLP. A filing with the Massachusetts Office of Consumer Affairs dated July 15, 2026 lists Social Security numbers as exposed. No other categories of information appear in the record.

Social Security Numbers Cannot Be Changed

Unlike a credit card or password, a Social Security number is permanent. Once it leaves your control you cannot revoke it, replace it, or reset it the way you can with other credentials. That single fact defines the long-term risk for anyone included in this incident. The number retains its value to identity thieves and fraudsters for years or decades after the breach.

The filing does not state when the incident occurred, only that Ernst & Young LLP submitted the notice on July 15, 2026. It also does not disclose the root cause, whether the data was viewed only or exfiltrated, or how the Social Security numbers were accessed. Those details remain unknown.

What This Exposure Enables

A Social Security number combined with basic personal information is one of the building blocks of identity theft. With it, someone can attempt to file fraudulent tax returns, open new financial accounts, apply for government benefits, or impersonate you in medical or employment records. Because the number never expires, the window for misuse does not close.

At the same time, the record contains no indication that passwords, login credentials, or financial account numbers were exposed. This means the breach does not put your existing Ernst & Young accounts at direct risk of takeover. The primary ongoing concern is new-account fraud and tax-related identity theft rather than immediate account compromise.

How to Determine If You Are Affected

Ernst & Young LLP is required to notify affected individuals directly, usually by mail. If you receive a letter from the firm, it will confirm whether your records were included and which specific information was involved. Absence of a letter usually means your information was not part of the 480 records listed in the filing. However, if you have moved since the incident, letters sent to an old address may not reach you. In that case, or if you have any doubt, contact Ernst & Young LLP directly to confirm your status.

The Persistent Nature of SSN Risk

Because Social Security numbers cannot be reissued on request, the exposure creates a permanent record that must be monitored indefinitely. Credit monitoring and identity theft protection services can alert you to suspicious activity, but they do not prevent someone from using the number. The most practical ongoing defense is vigilance: regularly reviewing tax transcripts, credit reports, and any unexpected mail from government agencies or creditors.

The scale of this filing — 480 people — is relatively contained compared with many large breaches. The limited number does not reduce the seriousness for those affected, but it does mean the organization was able to identify a specific subset of records rather than an entire database.

Placing This Incident in Context

This is not the first time Ernst & Young has appeared in state breach registries. Similar notices have been filed in Oregon and Vermont, indicating the matter is not limited to Massachusetts residents. The repeated appearances across states suggest the same underlying set of records triggered notifications in multiple jurisdictions.

What matters most to you is not the technical details of how the breach happened — which remain undisclosed — but the fact that your Social Security number, if included, is now a permanent piece of information that cannot be taken back. The focus shifts from prevention of the breach itself to management of its lifelong consequences.

Practical Steps That Address This Specific Exposure

• Request your annual tax transcript from the IRS. This lets you see whether anyone has filed a return using your Social Security number. Do this once per year; it is the fastest way to catch tax-related identity theft.
• Place a fraud alert or credit freeze with the three major credit bureaus. A freeze stops new creditors from accessing your file, making it far harder for someone to open accounts in your name. It is free and reversible.
• Review every unexpected communication from government agencies or financial institutions. Letters about new accounts, tax refunds you did not request, or benefit claims you never made are red flags that should be investigated immediately.
• Consider identity theft protection that includes dark-web monitoring for your Social Security number. While it cannot prevent misuse, early alerts give you the best chance to respond before damage spreads.
• File your taxes early each year. Getting your legitimate return on record before a fraudster can file a fake one is one of the simplest and most effective defenses against tax identity theft.

The letter from Ernst & Young remains the definitive answer on whether your information was exposed. For the 480 people named in the filing, the Social Security number exposure creates a permanent risk that requires ongoing attention rather than a one-time fix. Knowing exactly what was lost and what cannot be changed is the clearest guide for the protective steps that remain available.