The weakest link: the impact of cyber supply chain risk
Background
It has been reported that between 28 March and 12 April 2026 an unauthorised third party accessed a platform used by EY in connection with the provision of its client tax services, accessing and downloading documents relating to several of its clients. Information reportedly exposed included names, residential addresses, tax identification numbers, email addresses and financial information. Individuals connected with Goldman Sachs’ wealth management business and investment manager Man Group were among those subsequently notified of potential exposure.
Both Goldman Sachs and Man Group were clear that their own systems had not been compromised. Likewise, EY said that the incident had not affected its wider enterprise systems and that it was communicating with affected clients as its investigation progressed.
The incident is a stark reminder of the need to ensure that the security of third party software providers is being reviewed alongside the traditional security of an organisation’s own systems, and an understanding of the way in which these tools are being used in practice. Where information is shared with third parties, its protection also depends on the systems, processes and controls operated by that third party.
Understanding the supply-chain risk
A cyber supply-chain attack can be highly effective and have widespread impact. It may exploit a vulnerability in third-party software, compromise a supplier’s environment or obtain access through a trusted service provider. Once sensitive information is accessible through that route, the consequences can extend beyond the organisation initially affected to other organisations, individuals, and stakeholders.
The risk is particularly severe where businesses share confidential documents with external third parties as data will often be held in locations outside the client’s direct control. This also means that it may be difficult to monitor and escalate any unusual activity within those third party platforms.
For businesses, the consequences can extend well beyond the immediate loss of data. Confidential or market sensitive information may be exposed to competitors or criminals; the incident may give rise to heightened regulatory and stakeholder scrutiny; individuals may face risks of identity fraud; and affected organisations may incur investigation, notification, remediation and legal costs. A breach may also damage commercial relationships, particularly where clients have entrusted sensitive information to a service provider with the expectation that it would be protected.
Where do the legal risks arise?
A supply-chain incident can raise difficult questions about responsibility. Which party was responsible for the relevant security controls? Were contractual security requirements satisfied? Who should bear the costs of responding to the incident?
The answers will depend on the contractual arrangements, the applicable law and the specific facts in play. Relevant contractual provisions may include confidentiality obligations, data protection clauses, reporting obligations, security standards, audit rights, indemnities, exclusions and liability caps.
However, contractual arrangements alone will not necessarily resolve every claim. Depending on the circumstances, and the nature of the compromised data, statutory or regulatory obligations may also arise, including duties under applicable data protection legislation. Where personal data is involved, the parties’ respective roles and obligations must be assessed carefully; outsourcing data processing does not, by itself, remove an organisation’s regulatory responsibilities.
Timely advice on contractual requirements may not eliminate the risk of a breach through a third-party cyber-attack itself, but alongside appropriate cyber due diligence they can assist businesses to take pre-emptive measures and be better prepared in the event that they are faced with an incident.
Lessons learnt: practical steps for businesses
The EY incident provides several lessons for organisations seeking to reduce their exposure to increasing supply-chain risk.
Map your data and dependencies. Identify which third parties hold confidential or personal information, the systems through which it is accessed and the potential consequences of a compromise. Ensure this is kept under review to properly understand how and what data is being shared, used or accessed in practice.
Strengthen supplier due diligence. Assess suppliers’ security controls, vulnerability management, access restrictions and incident response arrangements. Revisit those assessments periodically rather than treating initial onboarding checks as sufficient.
Review contractual protections. Ensure that agreements address security standards, prompt incident notification, cooperation with investigations, access to audit evidence and remediation costs. Consider whether liability limits properly reflect the sensitivity and volume of data involved.
Prepare for an incident affecting a supplier. Test how the business would respond if a critical supplier suffered a breach affecting client information or access to systems.
Looking ahead
The EY incident is a reminder that cyber security requires a holistic approach, pulling together technical cyber security measures, commercial risk management, contractual protections and operational resilience.
Businesses cannot eliminate every vulnerability in their supply chains. They can, however, improve their understanding of where sensitive information sits, establish clearer expectations of suppliers and prepare for the possibility that a third party’s failure may become their own problem.