Baker Tilly Advisory Group has begun notifying clients about a data breach involving an external service provider, after an unauthorized actor obtained personal information belonging to certain clients and their dependents.
The compromised information was stored on a platform operated by a third-party provider that Baker Tilly uses to deliver its client services. According to the company's notification letter, Baker Tilly discovered the incident on September 6, 2026, and completed its review of the affected records on October 28, identifying the individuals whose information had been exposed.
In its notification, Baker Tilly stated that it became aware of a potential cybersecurity incident involving information maintained on the third-party platform. The company subsequently confirmed that an unauthorized party had obtained data associated with some of its clients.
Nearly 196,000 Individuals Reportedly Affected
Although Baker Tilly's notification does not disclose an overall number of affected individuals or identify the third-party service provider, regulatory disclosures provide further details about the incident's scale.
A filing submitted to the Texas Attorney General's Office lists 10,456 affected Texas residents. The disclosure identifies individuals' full names, addresses, Social Security numbers (SSNs), and other information among the compromised data categories.
The same filing reportedly records a nationwide impact of 195,512 individuals. Additional state disclosures include 1,359 affected residents in South Carolina and 2,689 in Massachusetts. However, the company has not independently provided a consolidated figure in its customer notification.
The sample notification letter published through state regulatory disclosures also contains an unfilled placeholder where the specific categories of compromised personal information should appear. Consequently, the Texas filing currently provides the clearest publicly available breakdown of the exposed information.
Baker Tilly Investigates Third-Party Security Incident
Following the discovery, Baker Tilly says it initiated containment measures and engaged external cybersecurity specialists to investigate the incident, establish its scope, and determine which information had been accessed. The company also notified law enforcement authorities and stated that it is cooperating with their investigation.
Baker Tilly maintains that its investigation has found no evidence of continued unauthorized access to its own network or systems. It has also reported no known instances of identity theft or fraud connected to the compromised information.
However, the absence of reported fraudulent activity does not establish that the exposed information cannot be misused in the future, particularly where government identification numbers and residential information are involved.
Affected Individuals Offered 24 Months of Experian Protection
To address potential consequences of the exposure, Baker Tilly is providing affected individuals with complimentary access to Experian IdentityWorks for 24 months.
According to the notification letter, the package includes credit monitoring, identity restoration assistance, and access to specialists who can help investigate and resolve identity theft incidents. The membership also includes up to $1 million in identity theft insurance, subject to the applicable policy conditions and exclusions.
The company has advised recipients to monitor their financial statements and credit reports for unfamiliar transactions or other suspicious activity.
Baker Tilly's Global Operations
Baker Tilly provides accounting, auditing, tax, consulting, and business advisory services. Its international network reported annual revenue of $6.8 billion for the financial year ending December 31, 2025, representing a 21.3% increase over the previous year.
According to its January 2026 financial announcement, the network comprises more than 50,400 professionals operating across 147 territories and 754 offices.
The company has not publicly identified the compromised service provider or explained how the unauthorized actor gained access to its platform. BleepingComputer also reported that it had contacted Baker Tilly seeking clarification about the incident, affected customer numbers, and compromised information but had not received a response at publication time.
No ransomware group had publicly claimed responsibility for the incident at the time of reporting.
