Skip to content
Ransomware

Baker Business & Tax Solutions listed by Global Secret Group

Global Secret Group has announced a data leak allegedly belonging to Baker Business & Tax Solutions, claiming to possess 213 GB of data.

By
Siberpol Intelligence Unit
Published
2 min read
2 min read
  • Ransomware group: Global Secret Group
  • Country: United States
  • Sector: Professional Services
  • Announcement date: July 26, 2026

The ransomware group known as Global Secret Group has listed the professional services firm Baker Business & Tax Solutions on its leak site. In an announcement made on July 26, 2026, the threat actor group claimed to have successfully exfiltrated a significant amount of data belonging to the organization.

The alleged data breach

According to the claims made by Global Secret Group, the breach occurred on March 21, 2026. The threat actor alleges that they have gained unauthorized access to the systems of Baker Business & Tax Solutions, leading to a large-scale data exfiltration event. While the announcement was made months after the alleged initial intrusion, the group continues to use its leak site to pressure victims by showcasing the scale of the stolen information.

Ransomware groups often utilize leak sites as a tool in a strategy known as double extortion. In this model, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information to use as leverage. If a victim refuses to pay the ransom to restore their systems, the attackers threaten to publish the stolen data publicly, causing reputational damage and legal complications for the target organization.

Details of the claimed data

The threat actor has provided specific metrics regarding the volume of information they claim to have stolen from the firm. The group asserts that the breach involves a massive amount of data, which includes the following details:

  • Total data size: 213 GB
  • Total file count: 817,209 files

While the group has provided these quantitative metrics, no specific details regarding the content of the leaked data have been provided. Although the group's announcement includes screenshots that display various file lists and directory structures, the exact nature of the files remains unconfirmed by the source.

About Baker Business & Tax Solutions

Baker Business & Tax Solutions is a Kentucky-based professional services firm. The organization specializes in providing accounting and tax solutions that are specifically tailored for legal practices. Because of its specialized focus, the firm handles sensitive financial and regulatory information on behalf of its clients.

Potential impact and industry implications

This incident may result in the exposure of sensitive data held by Baker Business & Tax Solutions. Given the firm's focus on accounting and tax services for legal practices, the leaked data could include client financial information and legal records. Such an exposure might lead to regulatory consequences under relevant US state laws and data protection standards. Furthermore, affected individuals may face an increased risk of identity theft or targeted phishing attacks.

The operational continuity of the firm could be negatively impacted by this potential data breach. For organizations operating within the professional services sector, particularly those handling sensitive financial or legal data, maintaining robust cybersecurity defenses is critical. Common defensive steps for organizations include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access via phishing.

Public information regarding the Global Secret Group is currently limited, making it difficult to attribute the attack to a specific geographic region or a known advanced persistent threat (APT) actor. As with many modern ransomware operations, the group's motivations and long-term objectives remain unclear.

From the Professional plan

Phishing & Brand Protection

Monitor domains, phishing pages, ads and listings that impersonate your brand, and open takedown requests from the panel.

Related stories