EY customers exposed their tax documents between March and April 2026 through a compromised support ticketing access point, with the exact number of affected customers remaining unclear.
The BfDI assesses the direct training of AI models with real tax data as data-protection-critical, since memorization of citizen data represents a known risk.
Tax authorities use real tax data not only for AI training but also during ongoing operations for validation, which requires data protection and EU AI Act compliance.
