# Baker Tilly Advisory Group client data breach via unnamed third-party service provider platform

> Baker Tilly Advisory Group is notifying clients that an unauthorized actor obtained personal information of clients and their dependents from a platform run by an unnamed third-party service provider. Baker Tilly became aware on 2026-09-06 and finished its data review on 2026-10-28; the Texas AG portal lists 10,456 affected Texas residents, including SSNs, names and addresses.

- **Published:** 2026-11-11T23:28:23Z
- **Last reviewed:** 2026-11-11T23:28:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5804
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5804.png
- **ID:** TL-2026-5804
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 8

## Description

Baker Tilly Advisory Group, a major U.S. accounting, tax and advisory firm and member of the Baker Tilly International network (US$6.8bn revenue for 2025, 147 territories, per the network's January 2026 announcement), is sending breach notices to clients and their dependents. According to the sample individual notice cited by BleepingComputer (published 2026-11-11), Baker Tilly became aware of a potential cybersecurity incident on 2026-09-06 involving a platform operated by a third-party service provider that Baker Tilly uses to serve clients. The notice states that an 'unauthorized actor was able to obtain data relating to certain Baker Tilly clients'.

Baker Tilly completed its review of the affected data on 2026-10-28 and identified the individuals concerned. The Texas Attorney General's public breach portal lists 10,456 affected Texas residents and the data types SSNs, full names, addresses and other information. The total number of individuals affected across all states has not been disclosed, and the notice template left the specific data elements as a placeholder. No other state AG filings were reported in the source.

The third-party provider has not been named, no threat actor or ransomware/extortion group has claimed the attack (BleepingComputer found no claims), and no CVE, malware, tooling or network indicators have been published. Baker Tilly states that it contained the incident, engaged external experts, notified law enforcement, has no evidence of unauthorized activity on its own network, and knows of no identity theft or fraud tied to the exposure. Affected individuals are offered 24 months of Experian credit and identity monitoring.

Analyst note: the MITRE ATT&CK mappings are low-confidence analyst inferences based on the generic pattern of a third-party platform compromise followed by data theft; the sources do not describe the intrusion vector, tooling or exfiltration method. The incident resembles other 2026 professional-services supply-chain breaches, such as the reported EY tax practice compromise of a third-party IT service management platform, but no link between the two has been stated by any source and none is asserted here. Severity is an analyst judgment driven by the sensitivity of the exposed PII (SSNs); no CVSS applies. The IOC set is therefore limited to entity, platform and behavioral indicators rather than network or file artifacts.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1567 Exfiltration Over Web Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Baker Tilly TL-2026-5804 — Third-Party Vendor Account Multi-Geo Okta Sessions (T1199/T1078)** (`TL-2026-5804-SPL-001`)

Behaviour-first hunt for the Baker Tilly Advisory Group incident pattern (TL-2026-5804): an unauthorized actor obtained client PII from a platform run by an unnamed third-party service provider (T1199 Trusted Relationship, T1078 Valid Accounts). Alerts when a vendor/contractor/partner/service account has successful Okta sessions from two or more countries or five or more distinct IPs within 24 hours, a common sign of a shared or stolen vendor credential. The research does not publish the intrusion vector, so this is a low-assumption behavioural lead, not an IOC match.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1199, T1078
- **Data sources:** okta
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=okta sourcetype="OktaIM2:log" eventType="user.session.start" outcome.result=SUCCESS earliest=-24h actor.alternateId IN ("*vendor*","*contractor*","*partner*","*svc-*") | stats dc(client.ipAddress) as distinct_ips dc(client.geographicalContext.country) as distinct_countries values(client.geographicalContext.country) as countries values(client.userAgent.rawUserAgent) as user_agents min(_time) as first_seen max(_time) as last_seen by actor.alternateId | where distinct_countries>=2 OR distinct_ips>=5 | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | table actor.alternateId distinct_ips distinct_countries countries user_agents first_seen last_seen
```

### Microsoft KQL

```kql
Okta_CL
| where TimeGenerated > ago(24h)
| where eventType_s == "user.session.start" and outcome_result_s == "SUCCESS"
| where actor_alternateId_s matches regex @"(?i)(vendor|contractor|partner|svc-)"
| summarize DistinctIPs=dcount(client_ipAddress_s), DistinctCountries=dcount(client_geographicalContext_country_s), Countries=make_set(client_geographicalContext_country_s, 10), UserAgents=make_set(client_userAgent_rawUserAgent_s, 5), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by actor_alternateId_s
| where DistinctCountries >= 2 or DistinctIPs >= 5
| project actor_alternateId_s, DistinctIPs, DistinctCountries, Countries, UserAgents, FirstSeen, LastSeen
```

### Sigma

```yaml
title: Okta Vendor or Service Account Session Start From External Address
id: 7c1e5a30-4b8d-5e21-9a3f-1d2c3b4a5f01
status: experimental
description: Detects successful Okta session starts by vendor, contractor, partner or service accounts from non-RFC1918 addresses. Static companion to the multi-geo aggregation in the SPL/KQL forms; supports third-party platform compromise triage (TL-2026-5804, Baker Tilly).
references:
    - https://www.bleepingcomputer.com/news/security/baker-tilly-notifies-clients-of-data-breach-at-third-party-provider/
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.initial_access
    - attack.t1199
    - attack.t1078
logsource:
    product: okta
    service: okta
detection:
    selection:
        eventtype: user.session.start
        outcome.result: SUCCESS
        actor.alternateid|contains:
            - vendor
            - contractor
            - partner
            - svc-
    filter_internal:
        client.ipaddress|cidr:
            - 10.0.0.0/8
            - 172.16.0.0/12
            - 192.168.0.0/16
    condition: selection and not filter_internal
falsepositives:
    - Legitimate vendor staff signing in from the vendor's own egress addresses
    - Service accounts used by SaaS integrations
level: medium

```

**Known false positives:**

- Vendor staff legitimately working from several offices or travelling
- Shared vendor accounts behind a rotating corporate VPN or proxy pool

**Tuning notes:** Replace the account-name wildcards with your real vendor/contractor naming convention or a group lookup. Raise distinct_ips for large vendors, allow-list known vendor egress ranges, and enrich with Okta ThreatInsight or MFA factor data. Run as a 30-day baseline before alerting.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5804 Entra ID Guest/Vendor Account Multi-Country Sign-Ins (T1199/T1078.004) (locked: unlock with TL Creds)
- TL-2026-5804 Bulk SharePoint/OneDrive Downloads by One User and IP (T1213) (locked: unlock with TL Creds)
- TL-2026-5804 Inbound Email Impersonating Baker Tilly Breach Notice (T1566) (locked: unlock with TL Creds)
- TL-2026-5804 Entra ID Partner Cross-Tenant Access Setting Change (T1199) (locked: unlock with TL Creds)
- TL-2026-5804 Azure Storage Account Keys Listed (T1530) (locked: unlock with TL Creds)
- TL-2026-5804 Rclone Cloud-Sync Exfiltration Command Line (T1567.002) (locked: unlock with TL Creds)
- TL-2026-5804 Bulk S3 GetObject Burst by Single Identity (T1530) (locked: unlock with TL Creds)
- TL-2026-5804 Large Outbound Upload to Consumer File-Sharing Services (T1567.002) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Baker Tilly notifies clients of data breach at third-party provider](https://www.bleepingcomputer.com/news/security/baker-tilly-notifies-clients-of-data-breach-at-third-party-provider/)
- [Baker Tilly sample individual notice (DocumentCloud)](https://www.documentcloud.org/documents/28880646-baker-tilly-sample-individual-notice/)
- [Texas Attorney General data security breach reports portal](https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage)
- [Baker Tilly International announces record revenues of US$6.8bn](https://www.bakertilly.global/news/baker-tilly-international-announces-record-revenues-of-us-6-8bn)
- [Ernst & Young discloses data breach after third-party IT platform compromised (comparable incident)](https://www.teiss.co.uk/news/ernst-young-discloses-data-breach-after-third-party-it-platform-compromised-17850)
- [EY says client tax data exposed in third-party IT software breach (comparable incident)](https://cyberinsider.com/ey-says-client-tax-data-exposed-in-third-party-it-software-breach/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5804