A third-party vendor system used by Ernst & Young for tax services was breached, exposing personal and financial data including Social Security numbers.