Goldman Sachs data breach history (2016-2026): the law-firm and EY incidents
Goldman Sachs has appeared in two recent breach stories, both about firms that hold its clients’ data: its outside law firm and an accounting firm. This page sets out what Goldman said, what the reporting adds, and what clients can do.
Short answer
Was Goldman Sachs hacked?
We found no confirmed breach of Goldman Sachs’s own systems from 2016 to 2026 in the sources we read. In both recent incidents Goldman said its own systems were not affected.
In December 2025 Goldman wrote to investors in some of its alternative investment funds that their data may have been exposed in a breach at its outside law firm, Fried, Frank, Harris, Shriver & Jacobson. In October 2026 Bloomberg and the Financial Times reported that clients of Goldman’s wealth management business were among those whose data was taken in a March-April 2026 breach at the accounting firm EY, which the ShinyHunters group claimed. Goldman said client assets were not affected.
Timeline at a glance
8 Oct 2026Bloomberg and FT: Goldman wealth clients’ data exposed in the EY breach; Goldman says its systems were not affected. (Bloomberg (Claims Journal))Reported
28 Mar – 12 Apr 2026Unauthorised access window at EY, per letters reported by Silicon UK; ShinyHunters claimed it. (Silicon UK)Reported
19 Dec 2025Goldman letter to alternative fund investors about a breach at its law firm Fried Frank. (PYMNTS / Bloomberg)Confirmed
13 Jan 2026JPMorgan files its own notice for the same Fried Frank breach (659 investors). (SecurityWeek)Confirmed
Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Goldman Sachs incident timeline, in detail
Confirmed = acknowledged by Goldman Sachs, a regulator filing or a court. Reported = credible reporting Goldman Sachs has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Mar – Oct 2026ReportedThird-party / accounting and tax firm
EY breach exposes data of Goldman wealth management clients
What happened. Bloomberg reported on 8 October 2026, citing a person familiar with the matter, that Goldman Sachs data was exposed in a hack of the accounting firm EY earlier in the year. The Financial Times first reported it and said Goldman’s wealth management division was affected, along with clients of the hedge fund Man Group. Silicon UK reported unauthorised access from 28 March to 12 April 2026 and that EY linked it to a vulnerability in Checkmarx software. The ShinyHunters group claimed the breach.
Impact. Per letters reported by Silicon UK: names, addresses, tax identifiers, email addresses and financial information. EY notified clients of its tax services in late September, per the FT. Goldman said its internal systems were not affected, client assets “remain safe”, and it is supporting affected clients. No count of Goldman clients has been published in the sources we read.
Law firm Fried Frank breached; Goldman warns alternative fund investors
What happened. In a letter dated 19 December 2025, reported by Bloomberg and summarised by PYMNTS, Goldman told investors in some alternative investment funds that Fried Frank had notified it of a cybersecurity incident. Fried Frank told Goldman its network was secure, the vulnerability had been fixed, and exposed data was “unlikely to be distributed or used improperly.” JPMorgan later filed a notice for the same incident, saying an unauthorised third party copied files from a Fried Frank shared drive.
Impact. Goldman said its systems “were not impacted by this incident and remain secure.” The number of Goldman investors affected was not published in the sources we read. In JPMorgan’s parallel notice the data included names, account numbers, SSNs and passport or ID numbers. Fried Frank faces lawsuits.
EY dates: Silicon UK gives 28 March to 12 April 2026 as the access window. Other secondary reports give different discovery dates; we use the window quoted from client letters.
Jones Day (April 2026): some secondary sites list Goldman among the 10 clients affected by the Jones Day law-firm breach. Jones Day named no clients, so we do not include it.
The pattern across the record
The data leaks through advisers, not the bank
Both incidents were at professional-services firms (a law firm and an accountant) holding client identity and tax data for fund and wealth work.
The bank tells clients, the vendor stays quiet
In the Fried Frank case Goldman, not the law firm, wrote to investors. Clients learn of these breaches from the bank, often months after the intrusion.
What it means for Goldman Sachs For Goldman Sachs wealth management clients and alternative fund investors — and what to do
If a Goldman or EY letter reached you, assume your tax ID and account details may be in criminal hands.
1.Work out what the letter says was taken
Tax identifiers, passport numbers and account numbers each need a different response.
We found no confirmed breach of Goldman Sachs’s own systems from 2016 to 2026. Its clients’ data was exposed through two vendors: the law firm Fried Frank (2025) and the accounting firm EY (2026). Goldman said its systems were not affected in either case.
Goldman Sachs data breach 2025: what happened?+
In December 2025 Goldman warned investors in some alternative investment funds that their data may have been exposed in a breach at its outside law firm, Fried Frank. A parallel JPMorgan notice for the same breach listed names, account numbers, SSNs and passport numbers.
Was Goldman Sachs affected by the EY data breach?+
Yes, according to Bloomberg and the Financial Times in October 2026: data on clients of Goldman’s wealth management business was taken in the March-April 2026 EY breach claimed by ShinyHunters. Goldman said client assets were not affected.
Is there a Goldman Sachs data breach settlement?+
We found no settlement involving Goldman for these incidents. A proposed class action over the Fried Frank breach targets the law firm.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Goldman Sachs. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.