Baker Tilly Client Data Exposed in Third-Party Security Breach

Global audit and consulting giant Baker Tilly Advisory Group has notified clients that their personal information, along with that of their family members, was exposed in a security incident. The firm stated that the data leak did not originate from its own internal network but rather from a third-party service provider platform used for client services.## Incident Details and ScaleBaker Tilly was alerted to the breach on September 6 of this year. An internal investigation and data analysis process continued until October 28, allowing the company to identify which clients were affected. While the official statement does not specify the total number of victims, records from the Texas Attorney General indicate that 10,456 individuals were affected in that state alone.Reportedly, the compromised data includes full names, residential addresses, and Social Security numbers (SSN). Baker Tilly, which operates in 147 countries and reports $6.8 billion in annual revenue, is currently working with law enforcement and cybersecurity experts to investigate the incident.## Company Response and RecommendationsThe company stated there is no evidence that attackers gained access to Baker Tilly’s internal network. Furthermore, there have been no reports of fraud or identity theft resulting from the incident at this time. As a precautionary measure, the firm is offering affected individuals 24 months of complimentary credit and identity monitoring services through Experian.While no hacking group has claimed responsibility for the attack, the incident highlights the critical importance of supply chain security. Large corporations frequently rely on third-party services, but these providers do not always meet the security standards required by their clients, often becoming the source of data leaks.For those utilizing international financial or consulting services, this case serves as a reminder to remain vigilant regarding where and how confidential information is stored. Transparency in data protection policies and rigorous auditing of third-party providers have become essential requirements in the modern business environment.