Recent security reporting described a data breach at EY involving a third party support ticket system. The reports say an attacker accessed files attached to support tickets in a platform provided by an external IT support provider. That detail matters for TPRM teams because support tickets often become quiet stores of sensitive documents.
This is not only a large company story. Many organisations send screenshots, forms, logs, identity documents, tax files, contracts, and health details through support channels. If those attachments are retained too long or exposed to broad access, the risk can grow outside the main business system.
What Happened
Public reporting says the incident involved unauthorised access to a third party support ticket system used by EY. The attacker reportedly obtained files that were attached to support tickets. EY stated in breach notices that its own systems were not compromised, based on the public reports.
What Data Was Affected
The data varied by person. Reports say affected information could include names, contact details, Social Security numbers, tax identifiers, driver licence details, passport details, financial information, health information, tax forms, payroll documents, contracts, and other files. Some reports also said account passwords and digital signatures may have been involved for certain people.
The Third Party Angle
Support platforms are easy to underestimate. They sit between customers, employees, service teams, vendors, and technical staff. A single ticket can include documents that were never meant to become part of a long term repository.
Why support tickets create risk
- Users attach documents to explain urgent problems
- Screenshots can reveal personal data and system details
- Tickets may be visible to several support roles
- Attachments may stay longer than the original issue
- External support providers may host or operate the platform
Protection Steps For TPRM Analysts
When a vendor handles support tickets, analysts should review the platform as a data processing environment. The review should cover what can be uploaded, who can access attachments, how long files stay, and what evidence is available after an incident.
Questions to ask support providers
- What file types can users attach to support tickets?
- Can sensitive file uploads be blocked or warned?
- Who can view ticket attachments?
- Are attachment downloads logged?
- How long are tickets and attachments retained?
- Can attachments be deleted without deleting the ticket record?
- How quickly will clients receive incident evidence?
- Which subcontractors support the ticket platform?
Contract Points To Review
The contract should state how support data is used, protected, retained, deleted, and reported during incidents. If sensitive documents may be attached, the contract should also address encryption, access review, evidence sharing, and notice timing.
SAFE TPRM AI Co-Worker is a 100% autonomous TPRM platform powered by 100+ specialized AI agents.
Practical Checklist
- Inventory vendors that operate support portals or ticket systems
- Identify whether tickets can include regulated data
- Review attachment access and download logging
- Set retention limits for tickets and files
- Confirm incident notice timing and cooperation duties
- Ask for evidence of access reviews
- Train business users not to upload unnecessary sensitive files
- Validate deletion steps during vendor exit
Analyst Takeaway
The EY incident shows that support workflows can carry the same sensitivity as core applications. TPRM analysts should not treat ticket systems as minor tools when they receive documents, identity data, tax data, or health data. Review the attachment path with the same care as any other sensitive data flow.
FAQ
What happened in the EY incident?
Security reporting says an attacker accessed a third party support ticket system used by EY and obtained files attached to support tickets.
What data was affected?
Public reporting says affected files may have included personal data, Social Security numbers, tax identifiers, driver licence data, passport data, financial information, health information, tax forms, and other documents. The exact data varied by person.
Why is this a third party risk issue?
The incident involved a support ticket system run by an external provider, which shows how helpdesk attachments can become sensitive data repositories.
What should TPRM analysts do now?
Analysts should review support platforms, attachment handling, retention, access controls, logging, and client notification duties for vendors that process sensitive documents.
Source links
