The most sensitive data in finance does not always sit inside a bank. It sits with the bank’s accountants, auditors and advisers — which is how an 11-day breach at EY, one of the world’s largest professional-services firms, quietly exposed clients of Goldman Sachs’ wealth management business. The incident never required an attacker to defeat a bank’s own defences. They only had to find the softer door next to it, in a vendor holding exactly the files that make wealthy clients worth targeting.
Wealth management data is a uniquely rich prize: identities, account details, tax information and the shape of a family’s finances, all in one place. Our business coverage has tracked the pattern across the sector — attackers increasingly route around hardened institutions by compromising the professional firms those institutions trust, then living quietly inside file systems for days before anyone notices. Eleven days of access is the detail that should worry every client whose data moves between firms.
The Vendor Problem Finance Cannot Outsource
Modern finance runs on delegation: audits, tax preparation, valuations and reporting all require client data to flow to outside firms, each with its own security posture, its own subcontractors and its own detection speed. Regulators have been tightening expectations accordingly — the FTC and financial regulators alike now treat vendor oversight as part of an institution’s own security duty, not an administrative detail. A firm can outsource the work; it cannot outsource the breach.
The uncomfortable arithmetic is that a client of Goldman Sachs effectively inherits the security of every firm Goldman and its advisers share data with, without ever choosing them. Notification letters, when they come, arrive from organisations the client may never have heard of, months after the exposure window closed. That gap — between where data rests and where clients think it rests — is where trust in private banking quietly erodes.
What Firms Are Expected to Do Differently
The defensive playbook is well understood, even if unevenly practised: minimise what is shared, encrypt and tokenise what must be, expire access instead of letting it accumulate, and monitor vendor environments with the same suspicion applied to your own. The SEC’s disclosure regime now forces public companies to surface material incidents quickly, which has changed boardroom incentives — detection speed and vendor inventories are board topics, not IT trivia. Firms are also re-papering contracts: breach-notification deadlines, audit rights and data-deletion duties are becoming standard clauses rather than favours.
Why Eleven Days Matters
In breach investigations, dwell time — the gap between intrusion and detection — is the number that decides how bad a bad week becomes. Eleven days is long enough for intruders to map a network, locate the repositories that matter and stage data for removal at leisure, yet short enough that the firm’s defenders will argue their monitoring worked. Both things can be true, and that is the uncomfortable point for the whole sector: the industry-standard detection window is measured in days and weeks, while the data at stake can be identified and copied in hours. Wealth clients pay for discretion as much as for returns, and discretion now depends on detection speeds at firms they have never heard of. Until vendor dwell times shrink toward the banks’ own, cases like this one will keep arriving with the same structure — a famous name in the headline, and a less famous one in the forensic report.
For clients, the practical lessons are blunter. Assume any document you hand to an adviser may live in several systems; ask who else holds your data; freeze credit and treat unexpected contact with suspicion after any notification, however vague. And for the industry, the EY case is one more entry in a ledger that keeps making the same point: in financial security, the perimeter is now the whole supply chain. Follow continuing coverage of finance and security on our homepage.
