Summary
Baker Tilly Advisory Group is notifying clients that a breach at a third-party service provider exposed personal information about them and their dependents. The provider is not named. The incident occurred on a platform that vendor operates and Baker Tilly uses for client services.
Timeline
- September 6, 2026: Baker Tilly learned of the potential incident.
- October 28, 2026: Baker Tilly finished reviewing the affected data and identified the individuals involved.
- November 2026: Notification letters and regulator filings began.
What Was Exposed
The Texas Attorney General's breach portal lists Social Security numbers, full names, addresses, and other information. Baker Tilly's notice leaves the data types as a placeholder. In the notice, the company says "the unauthorized actor was able to obtain data relating to certain Baker Tilly clients."
Scale
The notice gives no overall count. The Texas portal alone lists 10,456 affected individuals, so the national total is likely higher.
Baker Tilly's Response
- Contained the incident and hired outside experts to investigate.
- Notified law enforcement.
- Reports no evidence of unauthorized activity on its own network, and no reports of identity theft or fraud tied to the exposure.
- Offers 24 months of credit and identity monitoring through Experian.
No ransomware group had claimed the attack at the time of reporting, and the company did not respond to BleepingComputer's request for more detail.
Why It Matters
Professional services firms hold tax and financial data on clients and their families, and they depend on external platforms to process it. This is another case where the compromise sits at a vendor, outside the firm's own network, so internal monitoring would not detect it.
Recommended Actions
- If you receive a notice, enroll in the offered Experian monitoring.
- Consider a credit freeze with the major bureaus, and watch for fraudulent tax filings; an IRS Identity Protection PIN helps.
- Be alert to phishing that references Baker Tilly or your accountant.
- Organizations should inventory vendors that hold client PII, require breach-notification timelines in contracts, and ask what data is retained.