The scope of a data breach at Ernst & Young (EY) that occurred between March and April of this year has widened further, with the personal and financial information of Goldman Sachs wealth management clients and clients of UK-listed hedge fund Man Group being compromised.

EY first disclosed the incident in July, stating it originated from a vulnerability in Checkmarx software and affected EY, multiple clients, and many other organizations.

According to notifications sent to affected clients in late September, an "unauthorized third party" accessed the relevant platform between March 28 and April 12 and downloaded files involving multiple EY clients.

The notifications stated that the affected personal information included "names, addresses, tax identification numbers, email addresses, and financial information." The notifications were signed by Rob Canning, EY's deputy ethics and compliance officer based in New York.

In July, EY reported the incident to regulators in California, Texas, Massachusetts, and Vermont. That same month, the cybercriminal group ShinyHunters claimed responsibility for the hack on a dark web leak site.

The group is regarded by law enforcement as a loose collective of young hackers and has been responsible for large-scale data breaches at dozens of companies since 2020.

Last month, ShinyHunters claimed to have breached the FBI, stealing thousands of records of related personnel. A week later, Dutch police announced the arrest of an alleged leader of the group.

Brett Leatherman, assistant director of the FBI's cyber division, said the individual and his accomplices "are suspected of breaching more than 140 organizations and obtaining at least $70 million in ransom payments."

Goldman Sachs notified its wealth management clients last month that EY had engaged an independent cybersecurity firm to confirm the systems involved are now secure.

In a letter to clients dated September 24, Goldman Sachs said: "Goldman Sachs' technology risk team is independently reviewing its work, and we have asked EY to demonstrate through objective evidence and third-party verification that its remediation measures are effective."

A Goldman Sachs spokesperson said: "We have maintained regular contact with EY and are focused on working with them to support clients affected by their security incident. Goldman Sachs' systems were not affected by this incident, and Goldman Sachs client assets were not affected and remain secure."

A Man Group spokesperson said: "EY notified us of an incident involving third-party software. EY subsequently notified the affected individuals. This incident is independent of Man Group's systems, and our systems were not breached."

According to regulatory filings, EY notified Tishman Speyer in August that information related to investors in the global real estate developer could potentially be affected by the incident. Tishman Speyer's internal systems were not affected, and the company declined to comment.

An EY spokesperson said the incident "did not affect broader EY enterprise systems and does not pose a threat to ongoing operations." The spokesperson added: "EY has conducted a comprehensive review of the affected data, and the investigation is now in its final stages. We have directly notified clients of the results of our analysis at the conclusion of the review process."

Affected clients were informed that EY is providing credit monitoring and identity protection services through a third party.