Act21

Act21 operates as a subsidiary of the global accounting and advisory network Baker Tilly, with its headquarters located in France. The firm focuses on delivering corporate social responsibility services to organisations seeking to align their operations with social and environmental objectives. Its service offering is designed to support clients in developing and implementing strategies related to sustainability, stakeholder engagement, and responsible business practices. Act21’s work is situated within the broader CSR advisory market, where it leverages the Baker Tilly brand’s international reach. The company’s primary mandate is to help organisations translate CSR commitments into actionable plans and measurable outcomes.

The organisation’s client base spans multiple industries, as demonstrated by the cyber incident that affected a range of prominent clients in retail, finance, gaming, academia, and the public sector. This diversity indicates that Act21’s services are applicable across sectors that face increasing pressure to demonstrate responsible conduct. While specific figures on employee count or revenue are not disclosed in the available sources, the incident description suggests a notable footprint among major enterprises. The firm’s involvement with high‑profile clients implies a level of trust and established relationships within the CSR consulting space. Such a cross‑industry presence allows Act21 to bring varied perspectives to its advisory engagements.

Act21’s distinguishing attribute lies in its specialised focus on corporate social responsibility, a niche within the broader advisory portfolio of Baker Tilly. This specialisation enables the firm to offer deep expertise in areas such as ESG reporting, sustainability strategy, and social impact measurement. By concentrating on CSR, Act21 differentiates itself from generalist advisory practices that may only touch on responsibility topics peripherally. The firm’s positioning benefits from Baker Tilly’s global network, which can provide complementary resources in audit, tax, and technology when needed. These combined strengths allow Act21 to deliver integrated advice that connects responsibility goals with financial and operational considerations.

Structurally, Act21 is explicitly identified as a subsidiary of Baker Tilly, meaning its ultimate ownership rests with the Baker Tilly network. The parent company’s public clarification following the February 2024 cyberattack emphasized that client operations relying on the affected software were not directly disrupted, underscoring the subsidiary’s operational distinctness. The incident itself involved a ransomware‑style encryption of systems at Act21’s CSR‑focused subsidiary, which rendered client access to their software and data impossible while initial analysis indicated no data exfiltration. Recovery efforts involved external cybersecurity experts, and the timeline for restoration remained uncertain at the time of reporting. This event highlights both the vulnerabilities faced by specialised service providers and the importance of robust incident response planning within the Baker Tilly ecosystem.