Ernst & Young is warning clients their tax data was exposed. The twist: EY itself wasn't breached. A third-party support ticket system its IT staff used was, and client tax filings and the financial data behind them were sitting in those tickets.

Your most sensitive data rarely leaks from the system you hardened. It leaks from the helpdesk tool nobody put on the data map. And clients were told in July about an intrusion that ended in April.