British consulting and accounting giant Ernst & Young said it suffered a data breach that compromised the sensitive personal information of more than 30,000 Bank of America customers.

Ernst & Young (EY) provides consulting, advisory, and tax services to Bank of America. As part of those services, EY receives and handles information that contains the sensitive personal information of BANK of America customers.

In a recent filing with the office of the Attorney General of Maine, EY said that on 31st May, it was notified by its third-party supplier, Progress Software Corporation, of a security incident that involved the Clop ransomware gang exploiting a zero-day vulnerability in the MOVEit Transfer application.

After learning about the vulnerability exploitation, the company immediately took steps to secure its systems and launched an investigation with Bank of America to understand the scope of the security incident. Bank of America notified EY that its own systems weren’t affected by the security incident.

EY’s investigation revealed that certain files containing sensitive customer data was accessed by the threat actors. The compromised data included full names, addresses, financial account information, debit or credit card numbers, social security numbers, and other unique government-issued identification numbers.

The filing with the Maine Attorney General’s office also confirms that the data breach has affected at least 30,210 individuals. EY has started notifying all affected customers from August 9 and said that Bank of America is providing two years of complimentary credit monitoring and identity theft protection service through Experian IdentityWork. Also, a dedicated helpline has been set up where impacted individuals can call and get their queries answered.

“EY US takes this event seriously, and remains committed to protecting individuals’ personal information and assisting those who may have been affected by this incident,” EY said in its data breach notice.

Last week, in a notice of data breach, the Missouri Department of Social Services (DSS) disclosed that IBM, its service provider for Medicaid services, was a victim of the global cyber security incident resulting from the exploitation of a zero-day vulnerability in the MOVEit Transfer web application. This had a cascading effect on the agency as it works with IBM Consulting for several technology-focused services.

On June 13, IBM notified DSS about the data security incident and the agency immediately launched an investigation to understand the nature of the data compromised during the incident. It later concluded that the protected health information for Medicaid participants in Missouri was affected by the breach.

“The information involved in this incident may include an individual’s name, department client number (DCN), date of birth, possible benefit eligibility status or coverage, and medical claims information,” DSS explained.