Deloitte said in a statement that attackers accessed data from the company’s email platform, confirming some details in a report by the Guardian newspaper, which broke news of the hack on Monday.
The attack appeared to target the firm’s U.S. operations, was discovered in March and could have begun as early as October 2016, according to the Guardian. Deloitte’s statement did not confirm those details.
The breach at Deloitte, which says its customers include 80 percent of the Fortune 500, is the latest in a series of breaches involving organizations that handle sensitive financial data that have rattled lawmakers, regulators and consumers.
The U.S. Securities and Exchange Commission, Wall Street’s top regulator, and Equifax Inc (EFX.N), one of the largest credit-monitoring bureaus, this month reported that confidential filings and sensitive personal data were compromised by hackers.
The firm said it contacted government authorities immediately after it became aware of the incident, and notified each of the “very few clients” that had been affected.
Deloitte is a “Big Four” firm that provides accounting, auditing and consulting services, including advice on mergers and acquisitions. It also runs a cyber security business that helps customers defend their networks and investigate breaches.
The Guardian said Deloitte had contacted six clients. The company did not name the clients, confirm the number of clients it had contacted or say what type of data was stolen.
Deloitte said it had implemented a “comprehensive security protocol,” after the incident was discovered, using internal and external experts to help respond.
Still, he said the attack was “a big deal” because Deloitteholds sensitive information about its customers across business units that provide accounting services, review data on potential acquisitions and perform cyber security services.
A U.S. Federal Bureau of Investigation spokeswoman declined to comment, citing agency policy to neither confirm nor deny investigations.