It lasted eleven days, and for much of that time nobody outside a small circle of security specialists knew it had happened at all. A breach at EY — one of the world’s largest professional-services firms — quietly exposed information belonging to wealth management clients of Goldman Sachs, in an incident that underlines an uncomfortable truth of modern finance: your data is only as safe as the least secure firm that handles it.
Wealth clients are not ordinary account holders. Their files can contain account balances, tax information, estate structures and personal identification details — a combination that is extraordinarily valuable to criminals and extraordinarily damaging to the people affected. That such data could sit exposed through a third party, rather than inside the bank itself, is precisely what makes this case worth studying.
An 11-Day Window
According to the accounts that have emerged, unauthorised access persisted for eleven days before the intrusion was detected and contained. Eleven days is not an eternity in breach timelines — some intrusions run for months — but it is more than long enough for data to be viewed, copied or staged for removal. Incident responders generally work on the assumption that a determined intruder with more than a week of quiet access has had time to explore, and the forensic question becomes not whether they looked, but how much they took.
The delay between incident and public understanding is also familiar. Breaches at large firms pass through detection, containment, forensic investigation and legal review before clients are told anything, and each stage takes time. Guidance from agencies such as the Cybersecurity and Infrastructure Security Agency stresses that the first days after discovery should prioritise evicting the intruder and preserving evidence — but from a client’s perspective, the silence can feel like the story in itself.
Why Vendor Risk Is the Real Story
Goldman Sachs did not need to be breached for its clients to be exposed. That is the structural lesson. Banks, asset managers and family offices route enormous volumes of sensitive work through accounting firms, administrators, law firms and technology vendors. Each connection is a door, and attackers have learned that the side doors of professional-services firms are often less heavily guarded than the front doors of the banks themselves.
Regulators have been moving in this direction for years. Financial firms in the United States and Europe now face explicit expectations to inventory their critical vendors, test their controls and plan for a vendor’s failure — expectations reflected in the reporting work of bodies such as the FBI’s Internet Crime Complaint Center, which has documented the steady industrialisation of attacks on business supply chains. Our business coverage has repeatedly returned to this theme: the perimeter no longer ends at the firm’s own firewall.
What Firms Should Do Differently
The practical lessons are unglamorous and known in advance. First, data minimisation: vendors should hold the least client data necessary, for the shortest time necessary, so that a vendor breach cannot expose what the vendor never had. Second, contractual and technical verification — not annual questionnaires, but tested evidence of patching, access control and monitoring. Third, detection speed: eleven days of dwell time argues for monitoring that watches vendor connections with the same suspicion applied to the open internet.
For affected clients, the checklist is equally concrete: place fraud alerts, watch for phishing that uses real account details to sound convincing, and treat unexpected contact about investments or tax filings as hostile until verified through a known number. Wealth clients are prime targets for follow-on fraud precisely because criminals know the sums involved justify patience.
The Trust Question
Neither firm in this story is a careless operator, and that is the point. If an 11-day breach can expose the clients of one of the world’s most sophisticated banks through one of its most sophisticated advisers, then vendor risk is not a problem of incompetent firms — it is a property of the system itself. The firms that handle this era best will be the ones that assume a partner will eventually be breached and design accordingly: segmented access, minimised data, rehearsed disclosure. Clients, increasingly, will ask for exactly that before they sign. More on finance and security is on our homepage.
