Tishman Speyer Data Breach Traced to a Platform Used by Ernst & Young

According to a data breach notification filed with the Massachusetts Office of Consumer Affairs and Business Regulation, personal information belonging to Tishman Speyer investors was compromised during a security incident involving Ernst & Young LLP, a third-party accounting firm that provides tax services to the real estate company. Ernst & Young determined that an unauthorized third party accessed a third-party information technology service management platform between March 28, 2026, and April 12, 2026, downloading documents that contained client records. The accounting firm detected the anomalous activity on April 23, 2026, engaged an independent cybersecurity forensics firm to investigate and contain the incident, and notified federal law enforcement. Ernst & Young subsequently alerted Tishman Speyer on August 6, 2026, that investor records were potentially involved, and confirmed the specific affected individuals on August 25, 2026.

The breach occurred entirely within Ernst & Young’s vendor environment, and Tishman Speyer confirmed that its own internal corporate computer networks and systems were not accessed or impacted. While the notification indicates that unauthorized documents were downloaded from the vendor platform, neither company has reported evidence that the stolen investor information has been misused for fraud or identity theft. However, because sensitive records were removed from the vendor platform, affected individuals cannot fully rule out future risks to their personal data.

The notification letter, sent by Ernst & Young, fills in each person’s compromised data elements individually, so the copy on file with Massachusetts leaves that list blank. Massachusetts’ 2026 breach report records Social Security numbers as involved for the 24 Massachusetts residents notified. The notice also explicitly confirms that bank account numbers, individual income details, and personal net worth were not among the compromised materials.

Even when a company reports that it is not aware of any actual misuse, the unauthorized exposure of Social Security numbers and personal identifiable information can raise the risk of identity theft, financial fraud, or targeted phishing schemes. When compromised records include government identifiers tied to investment accounts, bad actors can attempt to assemble detailed profiles to exploit other financial relationships. Affected individuals should treat any communication claiming to involve their investments or tax records with heightened scrutiny.

Notification letters are being sent directly to individual investors and clients of Tishman Speyer whose personal tax information was handled by Ernst & Young. Massachusetts’ 2026 breach report lists 24 Massachusetts residents for Tishman Speyer’s filing. Tishman Speyer has not published how many of its investors were affected.

Ernst & Young also reported the incident to state regulators on its own in July 2026, including a sample notice filed with the California Attorney General on July 15, 2026. Those filings came before Ernst & Young told Tishman Speyer on August 6 that its investors were involved, so they do not show how many Tishman Speyer investors were affected. Individuals who invested in Tishman Speyer properties and receive a formal breach notice should verify that their contact details on file are current.

Following the confirmation of unauthorized activity within the third-party IT platform, Ernst & Young took steps to secure the affected environment, terminate unauthorized access, and conduct a forensic examination alongside an independent cybersecurity firm. The firm says it confirmed that the unauthorized access had been stopped, reviewed the compromised documents to determine which clients and investors were impacted, and notified federal law enforcement. Tishman Speyer coordinated with the vendor once notified in August 2026 to facilitate direct communications to affected investors.

To assist impacted individuals, Ernst & Young is offering 24 months of complimentary credit and identity monitoring services through Experian IdentityWorks for United States residents, including credit reporting, identity restoration support, and insurance coverage. Affected individuals residing outside the United States are being offered 24 months of Cyber Monitoring through Cyberscout, a TransUnion company, with enrollment required within 90 days of the letter’s date. Unique activation codes and deadlines are included in each letter.

If you received a notification indicating that your information was involved in the Tishman Speyer vendor data breach, taking immediate proactive steps can help reduce your vulnerability to fraud:

• Review your notification letter carefully. Check the specific personal data elements listed in your letter and locate your unique activation code and enrollment deadline for credit monitoring services.
• Place a fraud alert or credit freeze with the major credit bureaus. Contact Equifax, Experian, and TransUnion to place a freeze or alert on your credit files to prevent unauthorized accounts from being opened in your name.
• Order and inspect your free annual credit reports. Visit annualcreditreport.com to review your credit files from all three national bureaus for unfamiliar accounts, hard inquiries, or suspicious activity.
• Monitor your financial accounts and billing statements closely. Regularly review your investment statements, bank accounts, and explanation-of-benefits statements for any unauthorized transactions or irregular entries.
• Stay alert to phishing communications referencing the breach. Watch out for suspicious emails, phone calls, or text messages that claim to represent Tishman Speyer, tax authorities, or Ernst & Young asking for sensitive verification details.

This information is a general overview and is not legal advice; your situation may differ, and consulting a legal professional can help you understand rights that may apply to you.

If your personal data may have been involved in the Tishman Speyer data breach, do you know what your options are? Our nationally recognized, award-winning team is here to help you understand your rights. Wilshire Law Firm offers free consultations and free case reviews with a legal professional, and we are available 24/7. Because we work on a contingency basis, there are no fees unless you get paid.

Contact Wilshire Law Firm today to schedule your free case review and get your questions answered.