Skip to navigation

Threat reportData BreachTL-2026-5804

Baker Tilly Advisory Group client data breach via unnamed third-party service provider platform

highACTIVE

Baker Tilly Advisory Group is notifying clients that an unauthorized actor obtained personal information of clients and their dependents from a platform run by an unnamed third-party service provider. Baker Tilly became aware on 2026-09-06 and finished its data review on 2026-10-28; the Texas AG portal lists 10,456 affected Texas residents, including SSNs, names and addresses.

Key facts

IdentifiersTL-2026-5804
SeverityHIGH
First disclosed
Affected productsBaker Tilly Advisory Group Client data held on an unnamed third-party service provider platform
MITRE ATT&CK techniquesT1078 Valid Accounts, T1199 Trusted Relationship, T1213 Data from Information Repositories, T1530 Data from Cloud Storage, T1567 Exfiltration Over Web Service
MotivationUNKNOWN
Target sectorsprofessional-services, accounting, finance, tax-advisory
Target regionsNorth America
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5804 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Baker Tilly TL-2026-5804 — Third-Party Vendor Account Multi-Geo Okta Sessions (T1199/T1078)

Behaviour-first hunt for the Baker Tilly Advisory Group incident pattern (TL-2026-5804): an unauthorized actor obtained client PII from a platform run by an unnamed third-party service provider (T1199 Trusted Relationship, T1078 Valid Accounts). Alerts when a vendor/contractor/partner/service account has successful Okta sessions from two or more countries or five or more distinct IPs within 24 hours, a common sign of a shared or stolen vendor credential. The research does not publish the intrusion vector, so this is a low-assumption behavioural lead, not an IOC match.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1199, T1078
  • Data sources: okta
  • Severity: high
  • Confidence: medium

Splunk SPL

index=okta sourcetype="OktaIM2:log" eventType="user.session.start" outcome.result=SUCCESS earliest=-24h actor.alternateId IN ("*vendor*","*contractor*","*partner*","*svc-*") | stats dc(client.ipAddress) as distinct_ips dc(client.geographicalContext.country) as distinct_countries values(client.geographicalContext.country) as countries values(client.userAgent.rawUserAgent) as user_agents min(_time) as first_seen max(_time) as last_seen by actor.alternateId | where distinct_countries>=2 OR distinct_ips>=5 | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | table actor.alternateId distinct_ips distinct_countries countries user_agents first_seen last_seen

Microsoft KQL

Okta_CL
| where TimeGenerated > ago(24h)
| where eventType_s == "user.session.start" and outcome_result_s == "SUCCESS"
| where actor_alternateId_s matches regex @"(?i)(vendor|contractor|partner|svc-)"
| summarize DistinctIPs=dcount(client_ipAddress_s), DistinctCountries=dcount(client_geographicalContext_country_s), Countries=make_set(client_geographicalContext_country_s, 10), UserAgents=make_set(client_userAgent_rawUserAgent_s, 5), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by actor_alternateId_s
| where DistinctCountries >= 2 or DistinctIPs >= 5
| project actor_alternateId_s, DistinctIPs, DistinctCountries, Countries, UserAgents, FirstSeen, LastSeen

Sigma

title: Okta Vendor or Service Account Session Start From External Address
id: 7c1e5a30-4b8d-5e21-9a3f-1d2c3b4a5f01
status: experimental
description: Detects successful Okta session starts by vendor, contractor, partner or service accounts from non-RFC1918 addresses. Static companion to the multi-geo aggregation in the SPL/KQL forms; supports third-party platform compromise triage (TL-2026-5804, Baker Tilly).
references:
    - https://www.bleepingcomputer.com/news/security/baker-tilly-notifies-clients-of-data-breach-at-third-party-provider/
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.initial_access
    - attack.t1199
    - attack.t1078
logsource:
    product: okta
    service: okta
detection:
    selection:
        eventtype: user.session.start
        outcome.result: SUCCESS
        actor.alternateid|contains:
            - vendor
            - contractor
            - partner
            - svc-
    filter_internal:
        client.ipaddress|cidr:
            - 10.0.0.0/8
            - 172.16.0.0/12
            - 192.168.0.0/16
    condition: selection and not filter_internal
falsepositives:
    - Legitimate vendor staff signing in from the vendor's own egress addresses
    - Service accounts used by SaaS integrations
level: medium

Known false positives:

  • Vendor staff legitimately working from several offices or travelling
  • Shared vendor accounts behind a rotating corporate VPN or proxy pool

Tuning notes: Replace the account-name wildcards with your real vendor/contractor naming convention or a group lookup. Raise distinct_ips for large vendors, allow-list known vendor egress ranges, and enrich with Okta ThreatInsight or MFA factor data. Run as a 30-day baseline before alerting.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • TL-2026-5804 Entra ID Guest/Vendor Account Multi-Country Sign-Ins (T1199/T1078.004) · unlock with TL Creds
  • TL-2026-5804 Bulk SharePoint/OneDrive Downloads by One User and IP (T1213) · unlock with TL Creds
  • TL-2026-5804 Inbound Email Impersonating Baker Tilly Breach Notice (T1566) · unlock with TL Creds
  • TL-2026-5804 Entra ID Partner Cross-Tenant Access Setting Change (T1199) · unlock with TL Creds
  • TL-2026-5804 Azure Storage Account Keys Listed (T1530) · unlock with TL Creds
  • TL-2026-5804 Rclone Cloud-Sync Exfiltration Command Line (T1567.002) · unlock with TL Creds
  • TL-2026-5804 Bulk S3 GetObject Burst by Single Identity (T1530) · unlock with TL Creds
  • TL-2026-5804 Large Outbound Upload to Consumer File-Sharing Services (T1567.002) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5804.

8 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Baker Tilly Advisory Group, a major U.S. accounting, tax and advisory firm and member of the Baker Tilly International network (US$6.8bn revenue for 2025, 147 territories, per the network's January 2026 announcement), is sending breach notices to clients and their dependents. According to the sample individual notice cited by BleepingComputer (published 2026-11-11), Baker Tilly became aware of a potential cybersecurity incident on 2026-09-06 involving a platform operated by a third-party service provider that Baker Tilly uses to serve clients. The notice states that an 'unauthorized actor was able to obtain data relating to certain Baker Tilly clients'.

Baker Tilly completed its review of the affected data on 2026-10-28 and identified the individuals concerned. The Texas Attorney General's public breach portal lists 10,456 affected Texas residents and the data types SSNs, full names, addresses and other information. The total number of individuals affected across all states has not been disclosed, and the notice template left the specific data elements as a placeholder. No other state AG filings were reported in the source.

The third-party provider has not been named, no threat actor or ransomware/extortion group has claimed the attack (BleepingComputer found no claims), and no CVE, malware, tooling or network indicators have been published. Baker Tilly states that it contained the incident, engaged external experts, notified law enforcement, has no evidence of unauthorized activity on its own network, and knows of no identity theft or fraud tied to the exposure. Affected individuals are offered 24 months of Experian credit and identity monitoring.

Analyst note: the MITRE ATT&CK mappings are low-confidence analyst inferences based on the generic pattern of a third-party platform compromise followed by data theft; the sources do not describe the intrusion vector, tooling or exfiltration method. The incident resembles other 2026 professional-services supply-chain breaches, such as the reported EY tax practice compromise of a third-party IT service management platform, but no link between the two has been stated by any source and none is asserted here. Severity is an analyst judgment driven by the sensitivity of the exposed PII (SSNs); no CVSS applies. The IOC set is therefore limited to entity, platform and behavioral indicators rather than network or file artifacts.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1199 Trusted Relationship

Collection

T1213 Data from Information Repositories; T1530 Data from Cloud Storage

Exfiltration

T1567 Exfiltration Over Web Service

Remediation

Immediate actions

  • Affected individuals: enroll in the 24 months of Experian credit and identity monitoring offered by Baker Tilly
  • Place fraud alerts or credit freezes with the major credit bureaus and review credit reports and account statements for unfamiliar activity
  • Treat unsolicited contact referencing Baker Tilly, tax or advisory services as potential phishing, since names, addresses and SSNs may be in attacker hands
  • Clients of Baker Tilly: request written confirmation from the firm of which data sets and which third-party platform were involved

Workarounds

  • Consider an IRS Identity Protection PIN for tax filings where SSNs are exposed
  • Use credit freezes in place of reliance on monitoring alone

Longer-term hardening

  • Maintain an inventory of third-party platforms that hold client PII and review their access controls, MFA enforcement and logging
  • Apply data minimization and retention limits to client data stored on vendor-operated platforms
  • Include breach-notification, log-access and forensic-cooperation clauses in service provider contracts
  • Monitor vendors for credential exposure and infostealer activity and review vendor security ratings

Affected and fixed versions

  • Baker Tilly Advisory Group — Client data held on an unnamed third-party service provider platform
    Vulnerable versions: Not disclosed

Timeline

  • Baker Tilly International announces US$6.8bn revenue for 2025 across 147 territories, giving scale context for the firm's client base.
  • Comparable incident, not linked by any source: EY sends client notices about a third-party IT service management platform compromise exposing tax data.
  • Baker Tilly becomes aware of a potential cybersecurity incident involving a platform operated by a third-party service provider.
  • Baker Tilly completes its review of the affected data and identifies the individuals whose information was involved.
  • BleepingComputer publishes the first public report of the client notices; the provider, actor and total victim count remain undisclosed.
  • Texas Attorney General portal lists 10,456 affected Texas residents with SSNs, names and addresses (reported by 2026-11-11).

Sources cited

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats