Baker Tilly Advisory Group Notifies Clients of Third-Party Data Breach

Baker Tilly Advisory Group has begun notifying clients that a data breach occurred at a third-party provider. The breach compromised certain personal information belonging to clients and their dependents, according to BleepingComputer. The provider's identity, the root cause, and the exact scope of exposed data have not been made public.

Why It Matters

Baker Tilly is an advisory and accounting firm, so the exposed information may affect a broad client base. Third-party and supply-chain breaches are hard for the affected individuals to manage, because the clients and their dependents have no direct visibility into or control over the vendor's security. Breached personal data is often used for phishing, business email compromise, and identity theft.

What Defenders Should Watch For

• Organizations that share vendor relationships with professional services firms should review their third-party risk assessments and confirm current data-sharing agreements.
• Security teams should watch for a rise in targeted phishing or pretext calls referencing Baker Tilly, tax or advisory services, or related third parties.
• Clients and dependents who receive notification letters should monitor credit reports and be cautious of unsolicited messages claiming to be from Baker Tilly or its partners.
• Incident responders should watch for any public disclosure naming the specific third-party provider, since that would clarify which other organizations used the same vendor.

This is a developing story with limited technical detail disclosed so far. No CVE or specific attack vector has been confirmed publicly. Read the original report at BleepingComputer.