Accounting Firm Data Breach: How to Protect Your Data

Your accountant asked for last year’s tax slips, a void cheque and every shareholder’s social insurance number, and someone on your team emailed them over, which is how an accounting firm data breach quietly becomes your breach. Do you know where those files sit today? Many business owners in Canada could not answer that today, and that is normal.

You hire an accounting firm because you trust it with exactly this kind of data. The news from two of the world’s four largest accounting firms over the last two weeks is still a good reason to ask, because an accounting firm data breach rarely starts where the client is looking. In every case below, the risk sat somewhere the client never saw.

What the Latest Accounting Firm Data Breach Shows

EY has been notifying clients about a breach of a third-party IT service management platform used by its tax practice. According to SecurityWeek, an unauthorized party had access between March 28 and April 12, 2026, and EY spotted the activity on April 23. The exposed data included names, addresses, Social Security numbers, account numbers and card numbers.

EY’s own notice said support tickets on the platform “may include documents containing client tax information.” In plain terms, tax files could be attached to help desk tickets, and the help desk ran on an outside vendor’s software. A support queue is easy to leave off the list of places that hold client tax files, and that blind spot is the lesson of this accounting firm data breach.

The story grew in the last two weeks. Notices sent at the end of September went to people linked to Goldman Sachs’ wealth management business, Man Group and Tishman Speyer, according to the Financial Times as reported by Silicon UK on October 8. Goldman Sachs said its internal systems were not affected and that client assets remain safe.

Their data was exposed anyway, on a platform run for EY, not by any of them. Your data is only as safe as the weakest system that holds a copy of it. Many companies have never written down which systems those are.

Then, on October 9, a ransomware group called The Gentlemen added Deloitte to its leak site, according to the tracker ransomware.live. German outlet heise online reported on October 12 that the group had published no Deloitte data and gave no detail on what it claims to hold. Deloitte had not commented publicly as of October 12, and a listing is a claim made by criminals, not a confirmed breach.

Three More Warnings From the Same Two Weeks

Not every lesson from these two weeks involves a hacker. On October 12, an investigation by BBC Panorama, the Bureau of Investigative Journalism and OCCRP alleged that advisers, including Deloitte Cyprus, created or approved papers that made asset transfers look older than they were, according to the Cyprus Mail. Deloitte Cyprus said it acts in accordance with applicable law, Abramovich’s lawyers rejected the allegations, and no court has ruled on the allegations.

For an ordinary business, the takeaway is narrow: a record is only as trustworthy as your ability to prove when it was created and who changed it.

On October 8, the UK’s Financial Reporting Council fined Deloitte £6.05 million, discounted from £11 million, over its 2016 to 2020 audits of transport group Go-Ahead. That included a failure to challenge the retention of more than £30 million of public money. The FRC noted that the failures related to matters Deloitte itself had identified as significant audit risks.

Writing a risk down is not the same as dealing with it. The same is true of a vulnerability scan report that nobody acts on.

The pattern reached well beyond accounting. Overnight from October 11 to 12, attackers remotely forced the refrigeration systems in hundreds of French supermarkets into defrost, according to franceinfo, and E.Leclerc said the attack “affected one of its refrigeration equipment suppliers,” according to CBS News and AFP. Different industry, same lesson: the weak point sat with a supplier.

Here is the part people get wrong. None of these stories is really about one careless firm. The gap is evidence: can you show which outside firms hold your files, what they hold, and how fast they promised to tell you about an accounting firm data breach?

How to Protect Yourself: Seven Steps

None of these steps needs a security team. They need one person who owns them.

1. Send less: before a file goes out, ask whether your advisor needs every field in it. A social insurance number that never leaves your office cannot leak from someone else’s.
2. Use a secure portal, never attachments: ask your firm for a client portal with multi-factor authentication and links that expire. Never attach tax documents to an email, a chat or a help desk ticket, yours or theirs.
3. Ask your advisor three questions, in writing: which outside platforms will hold our files? How quickly will you tell us if one of them is breached? When do you delete our files after the engagement ends?
4. Put a notification timeline in the engagement letter: in the EY case, SecurityWeek reported client notifications going out in July for activity spotted in April. A clause with a number of days turns a promise into an obligation.
5. Act on a claim, not only on a confirmation: if a firm that holds your data is named on a leak site, ask your contact directly and change any passwords or access keys you share with them. Warn your team about phishing emails that quote real details from your files.
6. Lock down your own accounts: the Canadian Centre for Cyber Security’s baseline controls call for two-factor authentication wherever possible and a clear policy on password managers. Stolen details from an accounting firm data breach only help an attacker if they still open your accounts.
7. Keep records you can prove, and give every risk an owner: leave version history and audit logging on in Microsoft 365, and keep backups that hold earlier versions. A scan finding with no name next to it will still be open next year.

The same thinking applies to every supplier, not only your accountant. We covered the detection side of that in our guide to vendor cyber risk in Canada.

Where Secur-IT Data Fits

We cannot secure your accountant’s systems, and we will not pretend to. What our team runs is your side of the line, which is where an accounting firm data breach does its second round of damage.

• External threat and dark web monitoring tells you when your company’s logins or data turn up in criminal markets.
• Microsoft 365 account detection and response watches sign-ins and account behavior, so a stolen password gets flagged instead of quietly used.
• Email security filters the targeted phishing that tends to follow a breach.
• A managed password manager removes the reused passwords that turn one leak into many.
• 24/7 managed detection and response can contain a compromised machine at 2 a.m. and report after.

Being straight about our role here. We are not auditors, and we do not assess or certify your accounting firm. What we do is make sure that when someone else’s breach reaches you, you hear about it early and the stolen details do not open your own accounts.

Accounting Firm Data Breach Rules in Canada

Handing data to an outside firm does not hand over the responsibility. Under PIPEDA’s accountability principle, you are responsible for personal information in your control, including information you transfer to a third party for processing, according to the Office of the Privacy Commissioner of Canada. Clause 4.1.3 of PIPEDA also requires you to use contractual or other means to give that information a comparable level of protection while a third party processes it.

If an accounting firm data breach involves your customers’ personal information, PIPEDA’s reporting rules may reach you too. Employee information falls under PIPEDA only for federally regulated businesses, such as banks, airlines and telecoms, and Alberta, British Columbia and Quebec have their own private sector privacy laws, according to the OPC’s summary of PIPEDA requirements.

Where PIPEDA applies, a breach that creates a real risk of significant harm has to be reported to the Privacy Commissioner, and a record of every breach has to be kept for two years, according to the OPC’s guidance on mandatory breach reporting. Our PIPEDA data protection guide covers the rest in plain English.

Contracts matter here. PIPEDA points to contractual or other means, and in practice the contract is the main one, so your engagement letter is part of your security program whether you planned it or not.

Common Mistakes to Avoid

• Emailing tax slips, bank statements or social insurance numbers as attachments because it is faster.
• Assuming a large, well-known firm is immune to an accounting firm data breach.
• Waiting for the vendor to confirm a breach before changing shared passwords.
• Signing an engagement letter with no breach notification timeline in it.
• Treating a flagged risk as handled because it is written in a report.

Frequently Asked Questions

Q: What should I do after an accounting firm data breach?

After an accounting firm data breach, ask the firm in writing what data of yours was involved and which system was affected. Change any passwords or access keys you share with them and warn your staff about phishing that uses real details from your files. If customer information was exposed, check your reporting duties under PIPEDA; for employee information, PIPEDA applies only to federally regulated businesses, so others should check their provincial privacy law.

Q: How long does it take to put these protections in place?

The first three steps, sending less, using a portal and asking your advisor three questions, take days rather than months. Our managed security packages carry a written commitment to be fully deployed and monitored within 30 days of contract.

Q: Is a ransomware leak-site listing the same as a confirmed breach?

No. A listing is a claim made by the criminal group, and some are exaggerated or misattributed. It is still worth taking the cheap precautions, like rotating shared credentials and warning staff, while you wait for the named firm to confirm or deny.

Q: Am I still responsible under PIPEDA if my service provider is breached?

Under PIPEDA’s accountability principle you remain responsible for personal information you transfer to a third party for processing. You are required to secure comparable protection through contractual or other means, which is why the questions you ask before sending data matter.

Q: What is the safest way to send tax documents to my accountant?

Use the firm’s secure client portal with multi-factor authentication and links that expire. Avoid email attachments, chat messages and help desk tickets, because copies of those files tend to stay in systems nobody reviews.

If you want to know which outside firms hold your data and whether your own accounts would hold up after their breach, our team at Secur-IT Data can walk you through it.

References

1. SecurityWeek: Ernst & Young Data Breach Affects Personal, Financial Information
2. Silicon UK: Goldman Sachs Client Data Affected By EY Hack
3. heise online: Cybercriminals claim data leak at Confluent, Deloitte, KFC and MoneyGram
4. Financial Reporting Council: Sanctions against Deloitte LLP
5. Office of the Privacy Commissioner of Canada: PIPEDA Principle 1, Accountability

For securing AI systems as part of a modern security program, SecuritAI is built for exactly that.

Krikor Tengerian

Krikor Tengerian is the CEO and founder of Secur-IT Data Solutions, a Toronto-based cybersecurity firm focused on helping Canadian organizations secure their infrastructure and critical systems. With over 25 years of experience across cybersecurity and IT infrastructure, he has supported organizations in hardening networks, protecting critical workloads, and aligning security controls with business and regulatory requirements.​
Krikor actively shapes the direction and themes of Secur-IT’s educational content, collaborating with AI tools to structure, refine, and expand articles while providing the real-world context, use cases, and review to keep them accurate and practical for readers. He regularly shares insights on OT security, threat detection, incident response, and Canadian cybersecurity compliance to help industrial and commercial organizations better understand and reduce their cyber risk.