{"id":"CMP-202611-ybugvc","kind":"campaign","aliases":[],"related":[],"title":"Baker Tilly breached through a third-party provider: client names, addresses and Social Security numbers stolen; expect scams posing as Baker Tilly","description":null,"summary":"Baker Tilly Advisory Group (US accounting and advisory firm) is notifying clients that someone took data about them and their dependents from a platform run by an unnamed third-party service provider that Baker Tilly uses for client work. Breach date: 2 Sep 2026 (California AG filing). Baker Tilly found out on 6 Sep, finished its review on 28 Oct, and dated the notice letters 9 Nov 2026. Data exposed: names, addresses, Social Security numbers and other information (varies by person). Confirmed counts: 10,456 people in Texas and 111 in Rhode Island. Law-firm summaries of regulator data give a total of 195,512 (not confirmed by Baker Tilly). Baker Tilly says it has no evidence that anyone got into its own network. The provider's name and the attack method are unknown.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Baker Tilly","fixed":[],"vendor":"Baker Tilly Advisory Group","affected":"client data on a third-party provider platform"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Did you, or your business, get a Baker Tilly notice letter dated 9 Nov 2026, or are you a Baker Tilly client? Be wary of emails, calls or letters that claim to be from Baker Tilly or that quote your SSN or address and ask you to pay, verify your identity or click a link. The real notice came by US mail. No lure domains or subject lines have been reported yet (unknown).","fix":"If you are affected: freeze your credit with Equifax, Experian and TransUnion, enroll in any monitoring Baker Tilly offers, and file an IRS Identity Protection PIN request. Check any message about Baker Tilly by calling the firm on a number you already know, not one given in the message.","status":"open","published_at":null,"first_seen_at":"2026-11-11T23:25:47+00:00","triaged_at":"2026-11-11T23:25:47+00:00","updated_at":"2026-11-11T23:26:17+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-11T23:29:33Z","path":"third-party-breach","entry":"unknown","reason":"The record says the data was taken from a platform run by an unnamed third-party provider, while Baker Tilly reports no evidence of intrusion into its own network and the provider's name and attack method are unknown.","confidence":0.8}},"analyst_status":"done","analyst_note":null,"search":"'-202611':25A '10':117B '111':123B '195':138B '2':75B '2026':77B,101B '28':92B '456':118B '512':139B '6':86B '9':99B 'account':38B 'address':12A,105B 'advisori':35B,40B 'ag':79B 'anyon':153B 'attack':165B 'baker':1A,22A,27A,33B,67B,81B,143B,145B 'breach':3A,73B 'california':78B 'campaign':29B 'client':10A,44B,71B 'cmp':24A 'confirm':115B,141B 'count':116B 'data':48B,102B,133B 'date':74B,95B 'depend':53B 'earli':31B 'early-warn':30B 'evid':151B 'expect':18A 'expos':103B 'file':80B 'finish':88B 'firm':41B,129B 'found':83B 'give':134B 'got':154B 'group':36B 'inform':111B 'island':126B 'law':128B 'law-firm':127B 'letter':98B 'method':166B 'name':11A,104B,162B 'network':158B 'notic':97B 'notifi':43B 'nov':100B 'number':16A,108B 'oct':93B 'parti':8A,63B 'peopl':119B 'person':114B 'platform':56B 'pose':20A 'provid':9A,65B,160B 'regul':132B 'review':90B 'rhode':125B 'run':57B 'say':147B 'scam':19A 'secur':15A,107B 'sep':76B,87B 'servic':64B 'social':14A,106B 'someon':46B 'stolen':17A 'summari':130B 'texa':121B 'third':7A,62B 'third-parti':6A,61B 'tilli':2A,23A,34B,68B,82B,144B,146B 'tilly':28A 'took':47B 'total':136B 'unknown':168B 'unnam':60B 'us':37B 'use':69B 'vari':112B 'warn':32B 'work':72B 'ybugvc':26A","nicknames":["Baker Tilly breach"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["bakertilly","bakertillybreach","tilly"],"ptokens":["baker","tilly"],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"breach","search_a":"'-202611':25A 'address':12A 'baker':1A,22A,27A 'breach':3A 'client':10A 'cmp':24A 'expect':18A 'name':11A 'number':16A 'parti':8A 'pose':20A 'provid':9A 'scam':19A 'secur':15A 'social':14A 'stolen':17A 'third':7A 'third-parti':6A 'tilli':2A,23A 'tilly':28A 'ybugvc':26A","search_b":"'10':117B '111':123B '195':138B '2':75B '2026':77B,101B '28':92B '456':118B '512':139B '6':86B '9':99B 'account':38B 'address':105B 'advisori':35B,40B 'ag':79B 'anyon':153B 'attack':165B 'baker':33B,67B,81B,143B,145B 'breach':73B 'california':78B 'campaign':29B 'client':44B,71B 'confirm':115B,141B 'count':116B 'data':48B,102B,133B 'date':74B,95B 'depend':53B 'earli':31B 'early-warn':30B 'evid':151B 'expos':103B 'file':80B 'finish':88B 'firm':41B,129B 'found':83B 'give':134B 'got':154B 'group':36B 'inform':111B 'island':126B 'law':128B 'law-firm':127B 'letter':98B 'method':166B 'name':104B,162B 'network':158B 'notic':97B 'notifi':43B 'nov':100B 'number':108B 'oct':93B 'parti':63B 'peopl':119B 'person':114B 'platform':56B 'provid':65B,160B 'regul':132B 'review':90B 'rhode':125B 'run':57B 'say':147B 'secur':107B 'sep':76B,87B 'servic':64B 'social':106B 'someon':46B 'summari':130B 'texa':121B 'third':62B 'third-parti':61B 'tilli':34B,68B,82B,144B,146B 'took':47B 'total':136B 'unknown':168B 'unnam':60B 'us':37B 'use':69B 'vari':112B 'warn':32B 'work':72B","search_c":"","cause_entry":"unknown","cause_path":"third-party-breach","disclosures_checked_at":"2026-11-11T23:27:40+00:00","first_public_at":"2026-11-11T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-ybugvc","url":"https://www.bleepingcomputer.com/news/security/baker-tilly-notifies-clients-of-data-breach-at-third-party-provider/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-11T23:25:47+00:00","fetched_at":"2026-11-11T23:25:47+00:00","note":null,"cites":["https://www.bleepingcomputer.com/news/security/baker-tilly-notifies-clients-of-data-breach-at-third-party-provider/"]}],"documents":[{"id":129916,"url":"https://x.com/BleepinComputer/status/2120653250508526024","title":"@BleepinComputer: Baker Tilly notifies clients of data breach at third-party provider\nhttps://t.co","kind":"post","source":"x","publisher":null,"text":"Baker Tilly notifies clients of data breach at third-party provider\nhttps://t.co/TEYxgfyZd0\n\nhttps://t.co/TEYxgfyZd0\n\nlikes 4 reposts 1","published_at":"2026-11-11T23:01:49+00:00","relation":"describes","confidence":null,"note":null},{"id":129938,"url":"https://www.bleepingcomputer.com/news/security/baker-tilly-notifies-clients-of-data-breach-at-third-party-provider/","title":"Baker Tilly notifies clients of data breach at third-party provider","kind":"blog","source":"analyst","publisher":null,"text":"Baker Tilly Advisory Group notifying clients that data about them and dependents stored on a platform run by an unnamed third-party service provider was obtained by an unauthorized actor. Aware 6 Sep 2026; breach date 2 Sep 2026 per California AG; review done 28 Oct; letters dated 9 Nov 2026. Texas AG: 10,456 Texans; names, addresses, SSNs. Rhode Island 111. No evidence of access to Baker Tilly's own network.","published_at":"2026-11-11T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}