Third-Party Provider Breach Exposes Sensitive Client Data at Baker Tilly
Written by AI from the linked story. Not reviewed by an editor. How this works
Baker Tilly's clients suffered a data breach not because of a failure within Baker Tilly itself, but because a third-party platform they relied on was compromised, exposing Social Security numbers, names, and addresses for over 10,000 individuals. This incident highlights the critical risk that third-party vendors introduce into an organization's data security posture—your security is only as strong as the weakest link in your supply chain. Organizations that entrust sensitive personal data to external providers must rigorously assess, monitor, and contractually obligate those vendors to maintain adequate security controls. Failing to do so creates liability, regulatory exposure, and reputational harm even when the breach originates entirely outside your own systems.
Tactical Insight
Immediate actions
- Conduct an emergency security review of all third-party vendors currently holding sensitive personal data to identify other potential exposure points.
- Notify affected individuals promptly and provide credit monitoring as Baker Tilly has done, ensuring compliance with applicable breach notification timelines.
Long-term improvements
- Implement a formal Third-Party Risk Management (TPRM) program that requires vendors to meet defined security standards before onboarding and periodically thereafter.
- Contractually require third-party providers to report security incidents to your organization within a defined timeframe (e.g., 72 hours) and maintain cyber liability insurance.
- Apply data minimization principles so that third-party vendors only receive and retain the minimum personal data necessary for their function.
Detection measures
- Establish continuous monitoring or periodic audits of third-party vendor security posture using questionnaires, attestations, or independent assessments.
- Require vendors storing sensitive data to provide logging and alerting capabilities so anomalous access can be detected and reported promptly.