The Baker Tilly Advisory Group is notifying clients that a data breach has exposed certain personal information about them and their dependents. According to the company, the data was stored on a platform operated by a third-party service provider that Baker Tilly uses in delivering services to clients.
Timeline
Baker Tilly became aware of a potential cybersecurity incident on September 6, 2026. The company completed its review of the affected data on October 28, at which point it determined whose information was involved. The notification states that the unauthorized actor was able to obtain data relating to certain Baker Tilly clients.
Scope and exposed data
The breach notification does not state how many clients were affected, does not name the service provider, and does not specify the data types involved. Data published by the Office of the Texas Attorney General lists 10,456 individuals in Texas as impacted. That portal identifies Social Security numbers, full names, addresses, and other information as exposed data types.
Company response
Baker Tilly says it took immediate steps to contain the incident, engaged external experts to investigate, and notified law enforcement. The firm reports no evidence of unauthorized activity on its own network and no reports of identity theft or fraud tied to the exposed customer information. Affected individuals are being offered 24 months of credit and identity monitoring through Experian.
Open questions
- The source of the breach and the identity of the third-party provider remain undisclosed.
- The total number of affected clients has not been published beyond the Texas figure.
- No ransomware group has publicly claimed responsibility, according to the reporting outlet.
For security teams, the incident is a reminder that sensitive client data held by professional services firms can be exposed through their vendors, making third-party risk review and data minimization important controls.
