Who Is Accountable When a Vendor Breach Hits Baker Tilly's Clients?

What happened

Our read: Baker Tilly's breach letter carries the signature of its Chief Risk Officer and General Counsel rather than its security chief, a reminder that disclosure duties after a vendor failure sit with legal and risk functions as much as with the CISO^[1]. The firm told clients that on September 6, 2026 it learned of a possible cybersecurity incident tied to a platform run by a third-party service provider it uses to deliver client work, and that an unauthorized actor obtained data on certain clients^[1].

Baker Tilly said it finished reviewing the affected data on October 28, 2026, at which point it worked out whose records were touched before preparing notices^[1]. The exposed information is reported to include Social Security numbers, names and addresses, and the incident also reaches clients' dependents, including children^[2][3]. The firm has not named the vendor, has not given an overall victim count, and left the specific data categories as a placeholder in the template letter, though a Texas regulator filing puts the state total alone above ten thousand people^[3]. Baker Tilly operates across 147 countries and reports annual revenue of $6.8 billion, scale that puts a premium on how consistently the firm can track exposure across its vendor ecosystem^[3].

What this changes for accountability

We think the choice of signatory on the notice is itself a governance signal. A letter from the Chief Risk Officer and General Counsel, rather than from the security organization, tells regulators and clients where the firm has located ownership of the breach response, and it puts risk and legal, not only technical security staff, on the hook for the accuracy and timeliness of what clients were told^[1]. State breach-notification statutes generally judge an organization by the adequacy of its notice content and the speed of disclosure once the scope of a breach is known, not by which internal title drafted the letter, so this allocation does not reduce the CISO's exposure if investigators later probe the technical response^[1].

Our read: the roughly seven-week gap between discovery on September 6 and the completion of the data review on October 28 is the kind of interval that state attorneys general and plaintiffs' counsel tend to scrutinize, since most notification laws measure reasonableness from the point an organization determines what data and whose records were affected^[1]. Boards should expect to be asked, in any regulatory inquiry, whether that interval reflects the complexity of reconstructing records from a vendor's platform or a slower internal escalation path, and Baker Tilly's own account attributes the delay to the work of ascertaining whose information was involved before notice could be prepared^[1].

We think the unnamed, undisclosed-headcount vendor is the harder accountability problem. When a professional services firm cannot yet say which supplier held the data, how many people are affected, or precisely which data fields were exposed, clients and regulators are left relying on the firm's internal attestations rather than independent verification, and the gap between the notification template's placeholders and the Texas filing's concrete count of more than ten thousand individuals illustrates how incomplete the public picture still is^[3]. In our view, this is where board risk committees should be pressing: not only on Baker Tilly's own network controls, which the firm says showed no further unauthorized access once the incident was found, but on the contractual and oversight terms governing the third party that actually held the data^[1].

What boards and CISOs should ask

In our view, three questions belong on every board's agenda when a professional services or accounting firm reports a supplier-side breach of this kind. First, who inside the organization owns the decision on notification timing and content, and does that person report jointly to the general counsel and the security function, given that Baker Tilly's letter here came from the risk and legal side^[1]. Second, what contractual right does the firm have to compel a named, quantified accounting from a vendor before a mandated notification deadline arrives, since the current notice leaves the vendor unnamed and the victim count unstated outside a single state's regulatory filing^[3]. Third, how does the firm's credit-monitoring offer, here two years of Experian coverage with no mention of fraud or identity theft to date, map onto the actual sensitivity of the data exposed, including Social Security numbers belonging to minors^[1][2].

Our read: CISOs at firms with similar vendor dependencies should treat this as a cue to pressure-test their own incident playbooks for who signs external communications, how quickly a third party must hand over victim-level detail, and whether their board has visibility into vendor contracts before, not after, a breach notice goes out^[1]. Baker Tilly appointed Amy Bogac as its Chief Information Security Officer, an appointment announced in January 2025, and the current incident gives her seat a near-term test of how security, risk and legal coordinate on a live third-party disclosure, independent of any judgment on the breach itself Baker Tilly named Amy Bogac CISO^[1].

What is not known

Baker Tilly has not named the compromised service provider, has not disclosed a global victim total, and has not detailed which specific data elements beyond Social Security numbers were exposed for any given individual^[3]. The company has not said how the unauthorized actor obtained access, and no ransomware group has claimed credit for the intrusion^[3]. Reporters have not yet obtained comment from Baker Tilly on the vendor's identity or the total number of affected clients^[3].