Baker Tilly notifies clients of data breach at third-party provider

A confirmed data breach at Baker Tilly exposed 10,456 individuals.

The Baker Tilly Advisory Group is notifying clients that a data breach has compromised certain personal information about them and their dependents.

The company said the exposed data was stored on a platform operated by a third-party service provider Baker Tilly uses to serve clients.

Baker Tilly learned of the incident on September 6 and completed its review of the affected data on October 28, when it identified whose information was involved.

Data from the Office of the Texas Attorney General reports that Baker Tilly impacted 10,456 individuals in the state of Texas alone.

Globally, the company operates in 147 countries and reports an annual revenue of $6.8 billion.

Anyone whose data Baker Tilly held is potentially affected, specifically customers or users whose records were exposed.

Baker Tilly is a major accounting firm in the U.S., providing auditing, tax planning, compliance, advisory, and business operations services.

Furthermore, it says it currently has no evidence of unauthorized activity on its own network, and added that it has no reports of identity theft or fraud linked to the exposure of customer information.

Beyond the immediate exposure, Baker Tilly now has to rebuild trust with everyone whose data it held.

The breach notification does not provide a count of impacted clients, does not name the service provider, and leaves the specific data types exposed as a placeholder.

The portal lists Social Security numbers (SSNs), full names, addresses, and other information as exposed data types.

The access point here was stolen login credentials, not a technical vulnerability.

BleepingComputer did not find any announcements from ransomware groups claiming the attack.

After discovering the incident, the company says it took immediate steps to contain it, contracted external experts to investigate, and notified law enforcement authorities.

To mitigate the risks arising from the incident, the firm offers affected individuals 24 months of credit and identity monitoring through Experian.

BleepingComputer has contacted Baker Tilly for more information about the data breach, its source, the number of affected customers, and the type of data compromised, but we have not received a reply by the time of publishing.

If you have any relationship with Baker Tilly, watch for phishing attempts that reference this breach specifically -- stolen data often gets reused this way.

Any unsolicited message referencing this breach is worth treating with suspicion, since attackers commonly impersonate the breached company afterward.