Baker Tilly Alerts Clients to Data Breach Involving Third-Party Provider

Baker Tilly Advisory Group has notified clients of a data breach that has compromised certain personal information about them and their dependents.

The exposed data was stored on a platform operated by a third-party service provider used by Baker Tilly to serve its clients.

Baker Tilly became aware of the incident on September 6, 2026, and completed its review of the affected data on October 28, identifying the individuals whose information was involved.

The notification to customers states, “On September 6, 2026, Baker Tilly became aware of a potential cybersecurity incident involving certain information stored on a platform operated by a third-party service provider used by Baker Tilly in connection with services we provide to clients.”

The company confirmed that an unauthorized actor obtained data related to certain Baker Tilly clients.

The breach notification does not specify the number of impacted clients, the name of the service provider, or the exact types of data exposed.

According to data from the Office of the Texas Attorney General, Baker Tilly affected 10,456 individuals in Texas alone. The exposed data includes Social Security numbers (SSNs), full names, addresses, and other personal information.

Baker Tilly is a major accounting firm in the U.S., offering auditing, tax planning, compliance, advisory, and business operations services. The firm operates in 147 countries and reports an annual revenue of $6.8 billion.

Following the discovery of the breach, Baker Tilly took immediate steps to contain the incident, engaged external experts to investigate, and notified law enforcement authorities.

The company stated that it currently has no evidence of unauthorized activity on its own network and has not received reports of identity theft or fraud linked to the exposure of customer information.

To mitigate risks from the incident, Baker Tilly is offering affected individuals 24 months of credit and identity monitoring through Experian.

BleepingComputer has reached out to Baker Tilly for further information regarding the data breach, including its source, the number of affected customers, and the types of compromised data, but has not received a response as of the time of publishing.

No announcements from ransomware groups claiming responsibility for the attack have been found.

Source: BleepingComputer