The call every wealth-management client dreads usually starts with an apology from someone else. In this case, the exposure ran through EY: an 11-day breach at the global professional-services firm quietly put Goldman Sachs wealth management clients at risk, in an incident that shows how a financial firm’s security is only ever as strong as the vendors it trusts with its clients’ data.
The outline is sobering. Attackers had access inside EY’s environment for eleven days before the intrusion was contained. During that window, information connected to Goldman Sachs wealth clients — the private banking customers of one of the world’s most security-conscious firms — was exposed through no failure of Goldman’s own systems. The clients did everything right. Their bank, by most accounts, did a great deal right. The weakness sat one step removed, inside a professional-services provider holding data for legitimate business reasons.
Why vendor breaches hit differently
Financial firms have spent a decade hardening their own perimeters: multi-factor authentication, segmented networks, 24-hour security operations centres. That investment pushed attackers toward softer paths — the accountants, consultants, law firms and IT providers who plug into the same data with a fraction of the defensive budget. A firm like EY is not a soft target in absolute terms, but the principle holds across the industry: the supply chain is now the attack surface, and every vendor with client data is part of the bank’s security posture whether the contract says so or not.
Wealth management raises the stakes further. The data involved in private client relationships — identities, holdings, family structures, contact details — is precisely the material that enables convincing, targeted fraud. A phishing email built on real portfolio details does not look like phishing. That is why an 11-day dwell time matters: it is not only about what was taken, but about how long an intruder had to study it. Our cybersecurity coverage returns to this theme repeatedly, because dwell time is where breaches turn into campaigns.
The eleven days
Eleven days is, by industry standards, not an unusually long intrusion — median dwell times have historically run longer. That is exactly the point worth absorbing. Even a comparatively contained breach at a major firm, detected and closed in under a fortnight, was enough to expose the clients of a marquee wealth manager. Detection speed helps, but it does not rewind exposure. The data that left during those eleven days stays left.
For Goldman Sachs, the incident is a case study in inherited risk: the reputational and client-trust consequences land on the firm whose name the clients know, regardless of whose network failed. Wealth clients choose advisers on trust accumulated over decades; a vendor’s bad fortnight can spend it.
Lessons for financial firms
The practical lessons are unglamorous and specific. First, vendor inventories must be honest: firms cannot defend data flows they have not mapped, and professional-services engagements accumulate data access quietly over years. Second, access should expire. Standing vendor access to client data, granted for one engagement and never revoked, is the soft underbelly in most post-incident reviews. Third, contracts need teeth — breach-notification timelines, security requirements and audit rights that are exercised, not filed.
Fourth, and hardest, firms should rehearse the client conversation before they need it. Who tells affected clients, how fast, and with what concrete protections offered? In wealth management, the quality of that conversation is the incident response, as far as clients are concerned.
The wider pattern
Regulators on both sides of the Atlantic have been moving in this direction for years, pushing financial firms to treat third-party risk as their own risk, with registers, resilience testing and incident reporting to match. The EY–Goldman episode will be cited in those conversations for a while, because it compresses the whole argument into one story: a top-tier bank, a top-tier professional-services firm, eleven days, and clients exposed anyway.
The conclusion for the industry is not that vendors cannot be trusted — modern finance cannot function without them. It is that trust must be engineered: scoped, monitored, time-limited and tested. The firms that internalise that will still suffer breaches. They will just suffer smaller, shorter, less surprising ones. More security analysis is on Techno Poster.
