Overview
Baker Tilly Advisory Group is notifying clients that personal information belonging to some clients and their dependents was exposed through a third-party service provider used by the firm. Baker Tilly became aware of the incident on 6 September 2026 and completed its review on 28 October, identifying the individuals affected. The company has not disclosed the service provider, the total number of affected clients or the complete list of exposed information.
What Happened
According to Baker Tilly’s notification, an unauthorised actor accessed information stored on the external provider’s platform. Data reported to the Texas Attorney General indicates that at least 10,456 individuals in Texas were affected, with exposed information including names, addresses and Social Security numbers. Baker Tilly says it has found no evidence that its own network was compromised and has received no reports of identity theft or fraud connected to the incident.
Why It Matters
The incident highlights the growing risk of third-party data exposure, particularly for organisations such as accounting and advisory firms that handle highly sensitive financial, employment and personal information. Even when an organisation’s own infrastructure remains secure, a supplier holding customer data can become the point of compromise. This makes supplier security and data governance an important part of an organisation’s overall security perimeter.
Security Best Practices
Organisations should maintain an accurate inventory of the data shared with third parties and regularly review whether suppliers genuinely need access to that information. Vendor assessments should include access controls, encryption, vulnerability management, incident response, breach notification procedures and data retention. Where possible, sensitive information should be minimised, segmented and protected so that a compromise of one supplier does not expose an unnecessarily large amount of customer data.
Response and Recovery
Baker Tilly says it contained the incident, engaged external cybersecurity specialists and notified law enforcement. Affected individuals are being offered 24 months of credit and identity monitoring through Experian. Organisations responding to similar incidents should go beyond containment by determining exactly what information was accessed, identifying affected individuals, reviewing third-party access and monitoring for subsequent phishing, fraud or identity-theft activity.
Expert in the Cloud Insight
Your security boundary does not end at your firewall. If a third party stores or processes your customers’ information, that organisation effectively becomes part of your security ecosystem. The Baker Tilly incident reinforces the need for strong third-party risk management, data minimisation and supplier accountability. A mature security programme should be able to answer three questions at any time: What data does our supplier have, why do they have it, and what happens if they are compromised?
Expert in the Cloud – The Future Is Now.
Leave a Reply