EY's breach exposed clients of Goldman Sachs and Man Group

EY said a breach of a platform supporting its tax services exposed names, addresses, tax identification numbers and financial details of individuals linked to Goldman Sachs and Man Group, an intrusion it detected on April 23 and disclosed this week, according to Cyber Security News. Count the parties in that sentence. A platform was breached, EY is doing the disclosing, and the people whose tax identification numbers moved are clients of two other firms. That distance runs through today's whole security record, and every clock in it is measured from the wrong end.

The clock starts at the breached party

Advantest, the Japanese chip testing equipment maker, is notifying individuals that hackers stole their personal information in the ransomware attack it suffered in February 2026 (SecurityWeek). That is roughly eight months from attack to letter. EY's own gap, April 23 to this week, is close to six.

Both numbers are usually read as a disclosure failure, and they are. But notice who is doing the waiting. An individual whose tax details sat on EY's platform is not an EY customer and had no way to ask. The exposed party in both items has no relationship with the company holding the timeline, which means the one person with a reason to count the months is the one with no standing to start the clock.

The vendor patches, the exposed estate belongs to someone else

SonicWall patched a maximum-severity remote code execution flaw, CVE-2026-102255, in SMA 1000 models 6210, 7210 and 8200v, one of four vulnerabilities it disclosed this week, and said it was already being targeted by attackers (CSO Online). A patch is a file the vendor publishes. The appliance is in somebody else's rack, and "already being targeted" means the exploiting started before the fix existed.

Today's record holds one case where that geometry closes. Google shipped Chrome 155 with fixes for 247 vulnerabilities, roughly a dozen of them reported by a single researcher, Xinyang Ge (SecurityWeek). The useful detail is not the count. It is that the party fixing the flaw is the party that reaches the exposed person, in one release, needing nothing from them.

The duties being drafted sit above where the day's exposures happened

Australia's government is weighing mandatory AI incident reporting for frontier AI companies after an agentic attack using OpenAI agents compromised Medicare systems, with a parliamentary committee questioning OpenAI, Microsoft and Google executives over delayed breach notifications (Dark Reading). EU governments could agree the proposed Kids Act's safety-by-design rules by the end of the year, with Ireland prioritising that chapter of the file (MLex).

Both are real duties aimed at named, visible companies. Neither reaches the three places today's exposures actually occurred: a tax services platform, a chip testing equipment maker, and a remote access appliance on a customer's own premises. The frontier lab is the entity a committee can summon. The tax platform is the entity that held the tax identification numbers.

One round today prices that gap directly. Hadrian raised €35.68 million co-led by Forgepoint Capital International and SmartFin, bringing total funding to nearly €58 million for a platform that combines continuous exposure management with agentic penetration testing (EU-Startups). Continuous is the word carrying the thesis: a company finding its own exposure on its own schedule, rather than learning about it from a vendor advisory or a letter.

On today's record, the alternative is a notification about February, sent in October, to someone who was never the customer.