[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsrXSIaSYQ6c1dwzaoB4W0fAtV2K2oBsD7dCqYSzZRy0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"1551ca1b-8e66-4b99-aa0b-1a7f05efacce","third-party-provider-breach-exposes-sensitive-client-data-at-baker-tilly","dec6dc57-7e3e-46ba-b114-e6e8750f3951","Third-Party Provider Breach Exposes Sensitive Client Data at Baker Tilly","Baker Tilly's clients suffered a data breach not because of a failure within Baker Tilly itself, but because a third-party platform they relied on was compromised, exposing Social Security numbers, names, and addresses for over 10,000 individuals. This incident highlights the critical risk that third-party vendors introduce into an organization's data security posture—your security is only as strong as the weakest link in your supply chain. Organizations that entrust sensitive personal data to external providers must rigorously assess, monitor, and contractually obligate those vendors to maintain adequate security controls. Failing to do so creates liability, regulatory exposure, and reputational harm even when the breach originates entirely outside your own systems.","**Immediate actions:**\n- Conduct an emergency security review of all third-party vendors currently holding sensitive personal data to identify other potential exposure points.\n- Notify affected individuals promptly and provide credit monitoring as Baker Tilly has done, ensuring compliance with applicable breach notification timelines.\n\n**Long-term improvements:**\n- Implement a formal Third-Party Risk Management (TPRM) program that requires vendors to meet defined security standards before onboarding and periodically thereafter.\n- Contractually require third-party providers to report security incidents to your organization within a defined timeframe (e.g., 72 hours) and maintain cyber liability insurance.\n- Apply data minimization principles so that third-party vendors only receive and retain the minimum personal data necessary for their function.\n\n**Detection measures:**\n- Establish continuous monitoring or periodic audits of third-party vendor security posture using questionnaires, attestations, or independent assessments.\n- Require vendors storing sensitive data to provide logging and alerting capabilities so anomalous access can be detected and reported promptly.",[12,13,14,15,16],"NIS2 Article 21(2)(d)","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships","NIST SP 800-53 SA-9: External System Services","CIS Control 15: Service Provider Management","NIST CSF 2.0 GV.SC-04: Suppliers are known and prioritized by criticality",{"NIS2 Article 21(2)(d)":18,"CIS Control 15: Service Provider Management":19,"NIST SP 800-53 SA-9: External System Services":20,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":21,"NIST CSF 2.0 GV.SC-04: Suppliers are known and prioritized by criticality":22},"This point specifically requires organizations to implement security measures addressing supply chain risks, including the security practices of third-party service providers handling their data.","This control explicitly requires organizations to establish a process to evaluate and monitor service providers who hold sensitive data, addressing the gap that allowed this breach to go undetected until the third-party notified Baker Tilly.","SA-9 requires organizations to establish requirements for external providers and monitor compliance, which would have mandated security obligations on the third-party platform storing the sensitive personal data.","This control requires organizations to define and implement processes to manage information security risks associated with supplier access to their assets and data, directly applicable to this third-party breach.","This category requires organizations to identify and prioritize third-party suppliers based on the criticality and sensitivity of data they handle, enabling appropriate oversight of vendors storing Social Security numbers and other PII.","published","2026-11-12T00:20:24.210709+00:00","2026-11-12T00:20:24.197+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fbaker-tilly-notifies-clients-of-data-breach-at-third-party-provider\u002F","baker-tilly-notifies-clients-of-data-breach-at-third-party-provider-2fa347","Baker Tilly notifies clients of data breach at third-party provider",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":50,"name":51,"problem":52},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":54,"name":55,"problem":56},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]