Goldman Says Client Assets Are Safe. Its Risk Team Is Asking EY to Prove It

Wealth clients learned about the helpdesk in September

Letters that reached clients of Goldman Sachs' wealth business in late September carried an awkward confession: an unauthorized party had downloaded their tax documents from a support platform at EY, their tax accountant ¹. Individuals linked to Man Group (LSE: EMG) got the same news ¹. Goldman's presence in the stolen set surfaced publicly on October 6↗ ².

The systems were safe; the files were not

Goldman's public line is that its systems were untouched and client assets "remain safe" ², and that it is working with EY "to support any of our clients impacted by their security incident" ³. Man Group called the incident "independent of Man Group's systems, which were not compromised↗" ⁴. Wealth clients bought discretion, and discretion left the building as a helpdesk attachment: names, addresses, tax identification numbers and financial details, riding on internal IT support tickets ¹⁴.

In private, Goldman stopped taking EY's word

Goldman's September 24 letter to clients↗ is where the two lines meet ¹. It said EY had engaged an independent cybersecurity firm to verify the affected systems were secure, and that Goldman's own technology risk team was demanding "objective evidence and third-party checks" that the fixes worked ¹⁴. EY had spotted the unusual activity on April 23, 11 days after the intruder's window closed ¹. The entry point was reportedly a flaw in Checkmarx software; no CVE is identified ¹.

The only hard count is a floor

Filings with regulators in California, Texas, Massachusetts and Vermont↗ confirm a floor of 1,366 affected residents, the first verifiable measure of scale ⁵. Massachusetts lists at least 19 residents tied to Man Group, notified by EY on the fund's behalf ⁶. EY is offering 24 months of Experian identity monitoring, and enrollment closes October 31 ⁵.

EY's July notice found no evidence of misuse, a stage finding rather than a close ¹. The record is otherwise blunt: this is EY's third significant data security incident in less than three years, and all three trace back to a third-party vendor or platform ⁵. The one before this, MOVEit, exposed 30,210 Bank of America customers and settled this year for $2.5 million ⁵.

EY carries the bill; the wealth book carries the risk

The damage splits along a clean line: EY carries the direct bill (credit monitoring, filings in four states, the MOVEit settlement behind it), while Goldman's wealth franchise carries the attrition and regulator follow-on that no public statement can call back ¹⁵. EY says the incident never reached its broader enterprise systems and that its review is nearing completion ¹. Asked this week, it declined to comment ⁴.

Proof, not processes on paper

The demand in Goldman's letter matches what security vendors now say out loud. Darktrace's Nathaniel Jones, senior vice president of global threat intelligence, puts the 11-day detection gap down to method: attackers "using a legitimate account to browse and download files" ⁴. His standard for closing it is Goldman's: "organizations want proof that remediation has worked, not simply evidence that the right processes exist on paper" ⁴.

The count nobody has printed is the number that matters

No report establishes how many Goldman-linked individuals sit in the stolen set ¹. A class-action investigation into Man Group claims↗ is already open ⁶. Until that count and EY's review land, the tail on this incident stays unpriced, and each new state filing marks it again: EY has filed in only four so far ¹⁵.