It lasted eleven days. That is how long attackers reportedly had access inside systems at EY, the global professional-services firm, before the intrusion was detected — long enough to expose information belonging to wealth management clients of Goldman Sachs. The incident, quiet by the standards of headline breaches, is being studied across the financial sector precisely because of what it reveals: in modern finance, your security is only as strong as the least-defended supplier holding your clients’ data.
How a supplier breach reaches bank clients
Large banks do not operate alone. They rely on accounting firms, consultants, law firms and technology providers that legitimately need access to sensitive material — valuations, transaction documents, client identities and financial details. Attackers understand this ecosystem well. Rather than assault a bank’s hardened defences directly, they compromise a trusted third party and ride its legitimate access and data holdings. According to accounts of the EY incident, the intruders were able to view or copy information connected to Goldman Sachs wealth clients during the eleven days before the breach was shut down. Neither firm has suggested client funds were taken; in wealth management, however, the greater long-term danger is usually targeted fraud, because stolen personal and financial details are the raw material of convincing phishing and impersonation. Guidance from the Cybersecurity and Infrastructure Security Agency consistently identifies third-party and supply-chain access as one of the hardest risks for organisations to control.
Why eleven days matters
Dwell time — the interval between intrusion and detection — is the metric security professionals watch most closely. Eleven days is short compared with the months attackers sometimes enjoy, yet it proved sufficient to reach some of the most sensitive client data in finance. The timeline underlines a hard truth: detection speed alone cannot compensate for broad access. If a supplier’s accounts can reach deeply into client material, even a brief compromise has outsized consequences. Regulators have been tightening expectations in exactly this area; rules such as the European Union’s Digital Operational Resilience Act, detailed by the European Insurance and Occupational Pensions Authority and national regulators, now require financial firms to map, test and contractually govern their critical third-party providers.
Lessons for financial firms
The practical takeaways are unglamorous but proven. Limit what suppliers can access, for how long, and from where; segment vendor connections so one compromise cannot roam; monitor third-party activity with the same suspicion applied to strangers; and rehearse the joint incident response before it is needed, because the first hours of a cross-company breach are usually lost to confusion about who calls whom and who tells the clients. Firms are also reassessing how much client data suppliers retain after an engagement ends — data that no longer exists cannot be stolen. Above all, the sector is absorbing the discipline of assuming breach and designing for containment.
Clients are asking harder questions
The audience for these lessons is no longer only chief information security officers. Wealth clients and their family offices increasingly interrogate the whole chain of firms that touch their data — banks, accountants, lawyers and consultants alike — and expect evidence, not assurances, about monitoring, access control and incident notification. Advisers report that vendor security has become a competitive topic in its own right: firms that can demonstrate short detection times, tightly scoped supplier access and rehearsed response plans use them as selling points. That client pressure may ultimately move standards faster than regulation, because it attaches a direct commercial price to every day of undetected intrusion.
The trust question
Wealth management sells trust as much as returns. Clients who chose a bank for discretion will judge it, in part, by the company it keeps and the rigour with which it supervises that company. Expect vendor security questionnaires to become audits, audits to become continuous monitoring, and contracts to carry sharper breach-notification duties measured in hours, not days. The EY incident will fade from the news cycle quickly; the eleven days at its centre should not fade from the industry’s memory. Read more finance and security coverage in our finance section and on the Newsletter Issues homepage.
