[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmeiwPhFkQOtKkFOWMemMIPnGeXLYc4IX0DQDKjfbUoE":3},{"article":4,"iocs":40,"watch_terms":41,"solutions":42,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"dec6dc57-7e3e-46ba-b114-e6e8750f3951","Baker Tilly notifies clients of data breach at third-party provider","baker-tilly-notifies-clients-of-data-breach-at-third-party-provider-2fa347","The Baker Tilly Advisory Group is notifying clients that a data breach has compromised certain personal information about them and their dependents. [...]","Baker Tilly is notifying clients about a data breach that compromised personal information stored on a third-party provider's platform. The incident, discovered on September 6, exposed data for at least 10,456 individuals in Texas, including Social Security numbers, full names, and addresses. The company has engaged external experts, notified law enforcement, and is offering affected individuals 24 months of credit and identity monitoring.","Baker Tilly reports data breach at third-party provider affecting over 10,000 individuals.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fbaker-tilly-notifies-clients-of-data-breach-at-third-party-provider\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F11\u002Fbakertilly.jpg","2026-11-11T23:01:31+00:00","2026-11-12T00:00:16.457184+00:00",7,[17,20],{"name":18,"type":19},"Baker Tilly","vendor",{"name":21,"type":19},"Experian","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":22,"icon":24,"name":25,"slug":26},null,"Breaches","breaches",[28,33,35],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":34},{"id":22,"icon":24,"name":25,"slug":26},{"category":36},{"id":37,"icon":24,"name":38,"slug":39},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[],[18,21],{"controls":43,"vendors":127},[44,72,98],{"slug":45,"name":46,"problem":47,"products":48},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[49,57,65],{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":53,"product_name":54,"url":55,"description":56},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":67,"url":70,"description":71},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":73,"name":74,"problem":75,"products":76},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":94,"product_name":95,"url":96,"description":97},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"slug":99,"name":100,"problem":101,"products":102},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",[],{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":138},"third-party-provider-breach-exposes-sensitive-client-data-at-baker-tilly","Third-Party Provider Breach Exposes Sensitive Client Data at Baker Tilly","Baker Tilly's clients suffered a data breach not because of a failure within Baker Tilly itself, but because a third-party platform they relied on was compromised, exposing Social Security numbers, names, and addresses for over 10,000 individuals. This incident highlights the critical risk that third-party vendors introduce into an organization's data security posture—your security is only as strong as the weakest link in your supply chain. Organizations that entrust sensitive personal data to external providers must rigorously assess, monitor, and contractually obligate those vendors to maintain adequate security controls. Failing to do so creates liability, regulatory exposure, and reputational harm even when the breach originates entirely outside your own systems.",[133,134,135,136,137],"NIS2 Article 21(2)(d)","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships","NIST SP 800-53 SA-9: External System Services","CIS Control 15: Service Provider Management","NIST CSF 2.0 GV.SC-04: Suppliers are known and prioritized by criticality",{"NIS2 Article 21(2)(d)":139,"CIS Control 15: Service Provider Management":140,"NIST SP 800-53 SA-9: External System Services":141,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":142,"NIST CSF 2.0 GV.SC-04: Suppliers are known and prioritized by criticality":143},"This point specifically requires organizations to implement security measures addressing supply chain risks, including the security practices of third-party service providers handling their data.","This control explicitly requires organizations to establish a process to evaluate and monitor service providers who hold sensitive data, addressing the gap that allowed this breach to go undetected until the third-party notified Baker Tilly.","SA-9 requires organizations to establish requirements for external providers and monitor compliance, which would have mandated security obligations on the third-party platform storing the sensitive personal data.","This control requires organizations to define and implement processes to manage information security risks associated with supplier access to their assets and data, directly applicable to this third-party breach.","This category requires organizations to identify and prioritize third-party suppliers based on the criticality and sensitivity of data they handle, enabling appropriate oversight of vendors storing Social Security numbers and other PII."]