Baker Tilly breach: client data taken from a third-party provider’s platform, including Social Security numbers
Baker Tilly says an unauthorised actor took client data from a third-party platform. Texas lists 10,456 affected people, with SSNs among the data.
What happened
Baker Tilly Advisory Group, the US accounting, tax and advisory firm, is sending breach notices to clients after an unauthorised actor took data from a platform run by a third-party service provider the firm uses to serve clients. In its notice, the firm says it became aware of a potential cybersecurity incident on September 6, 2026, involving information stored on that platform, and that “the unauthorized actor was able to obtain data relating to certain Baker Tilly clients.” Baker Tilly says it contained the incident, brought in outside experts to investigate and notified law enforcement, and that it has no evidence of continued unauthorised access to its own network. Its review of the affected data was completed on October 28, when it identified whose information was involved, and the notification letters are dated November 9. The firm has not named the service provider, has not said how the actor got in, and says it has no reports of identity theft or fraud linked to the exposure so far. BleepingComputer, which reported the notices on November 11, found no ransomware group claiming the attack.
Who is affected
The people notified are certain Baker Tilly clients, and their dependents, whose personal information was held on the third-party platform. Baker Tilly’s own notice does not give a total number of people affected, does not name the provider, and leaves the specific data types in the sample letter as a placeholder. The regulator figures that are public come from the Office of the Texas Attorney General: its breach portal lists 10,456 individuals affected in Texas alone, and lists the exposed data types as Social Security numbers, full names, addresses and other information. Texas is one state’s count for a national firm, so the full total is larger than 10,456 by an amount the firm has not disclosed. The firm is offering the people it notifies 24 months of credit and identity monitoring through Experian at no cost.
How serious
A Social Security number joined to a full name and address is the core identity-fraud set: it is what a criminal needs to attempt new-account fraud, and it is also the combination used in tax-refund fraud, where a false return is filed in the victim’s name to steal the refund. Unlike a card number, a Social Security number cannot simply be reissued, so this exposure does not expire. The dependents named in the notices widen the risk: a child’s Social Security number can be used for years before the misuse surfaces, because nothing normally shows up on a credit file that nobody is checking. The monitoring Baker Tilly is offering can alert victims after an account is opened in their name; it does not stop the account being opened. The firm’s statement that it has no reports of identity theft linked to the incident covers the period since September — misuse of data like this often starts months after a breach, using details quoted from the real client relationship to make the approach believable.
What to do now
If you receive a Baker Tilly notice, enrol in the Experian monitoring offered, and do the step that actually blocks new accounts: place a free credit freeze with each of Equifax, Experian and TransUnion for yourself, and ask about a protected-consumer freeze for any dependent named in the notice. Get an IRS Identity Protection PIN before tax season so a return in your name cannot be filed without it, and treat any unexpected tax notice, refund letter or benefits letter as a signal to act at once. Be alert to phishing that quotes real details from your Baker Tilly relationship — a message that knows your name, address and adviser is not thereby genuine — and contact the firm using a number you already hold, never one supplied in an unexpected message. If you are a Baker Tilly client and have not received a letter, no action is required on the firm’s account, but a freeze costs nothing and protects against every breach, not just this one.
Sources: BleepingComputer, “Baker Tilly notifies clients of data breach at third-party provider,” November 11, 2026 (reporting Baker Tilly’s customer notification and the Texas Attorney General’s breach portal listing)