Baker Tilly Advisory Group is notifying clients that a data breach involving a platform operated by a third-party provider compromised certain personal information; Texas Attorney General data reports 10,456 individuals affected in Texas, with Social Security numbers, full names and addresses listed among exposed data.
The accounting firm said it learned of the incident on September 6, 2026, and completed its review of the affected data on October 28, when it identified whose information was involved.
“On September 6, 2026, Baker Tilly became aware of a potential cybersecurity incident involving certain information stored on a platform operated by a third-party service provider used by Baker Tilly in connection with services we provide to clients,” the company said in a notification to customers. “The unauthorized actor was able to obtain data relating to certain Baker Tilly clients.”
The breach notification does not provide a count of impacted clients, does not name the service provider, and leaves the specific data types exposed as a placeholder. However, data from the Office of the Texas Attorney General reports that Baker Tilly impacted 10,456 individuals in the state of Texas alone. The portal lists Social Security numbers, full names, addresses, and other information as exposed data types.
Baker Tilly is a major U.S. accounting firm providing auditing, tax planning, compliance, advisory and business operations services. Globally, the company operates in 147 countries and reports annual revenue of $6.8 billion.
The company said it took immediate steps to contain the incident, contracted external experts to investigate, and notified law enforcement authorities. It said it currently has no evidence of unauthorized activity on its own network, and added that it has no reports of identity theft or fraud linked to the exposure of customer information.
To mitigate risks, the firm is offering affected individuals 24 months of credit and identity monitoring through Experian.
BleepingComputer said it did not find any announcements from ransomware groups claiming the attack.
Analysis
Why This Matters
- The breach affects clients of a major accounting firm, potentially exposing highly sensitive financial and personal data.
- The incident at a third-party provider highlights supply-chain cybersecurity risks that can affect even large organisations.
- The number of affected individuals may be significantly larger than the Texas figure when all states are considered.
Background
Baker Tilly is one of the largest accounting and advisory firms in the United States, with global operations in 147 countries. The company provides services including auditing, tax preparation and business consulting. Data breaches at third-party service providers have become a growing vector for cyberattacks, as attackers target smaller or less secure vendors to gain access to the data of larger organisations.
Key Perspectives
Baker Tilly: says it took immediate steps to contain the incident, hired external experts, and notified law enforcement. It states it has no evidence of unauthorised activity on its own network and no reports of identity theft or fraud linked to the exposure.
Texas Attorney General's Office: reports through its data breach portal that 10,456 individuals in Texas were affected, with Social Security numbers, full names and addresses among the exposed data types.
What to Watch
- Whether Baker Tilly names the third-party service provider involved in the incident.
- Any broader notification of affected clients in other states and the total number impacted.
- Potential regulatory investigations or class-action lawsuits stemming from the breach.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe headline says a Baker Tilly breach exposed client data through a third-party platform incident.BleepingComputer: “The Baker Tilly Advisory Group is notifying clients that a data breach has compromised certain personal information about them and their dependents. The company said the exposed data was stored on a platform operated by a third-party service provider Baker Tilly uses to serve clients.”
- SupportedTexas Attorney General data lists 10,456 affected individuals and includes Social Security numbers, full names and addresses among the exposed data types.BleepingComputer: “Data from the Office of the Texas Attorney General reports that Baker Tilly impacted 10,456 individuals in the state of Texas alone. The portal lists Social Security numbers (SSNs), full names, addresses, and other information as exposed data types.”
- SupportedBaker Tilly Advisory Group is notifying clients about personal information compromised on a platform operated by a third-party provider.BleepingComputer: “The Baker Tilly Advisory Group is notifying clients that a data breach has compromised certain personal information about them and their dependents. The company said the exposed data was stored on a platform operated by a third-party service provider Baker Tilly uses to serve clients.”
- SupportedBaker Tilly said: “On September 6, 2026, Baker Tilly became aware of a potential cybersecurity incident involving certain information stored on a platform operated by a third-party service provider used by Baker Tilly in connection with services we provide to clients.”BleepingComputer: ““On September 6, 2026, Baker Tilly became aware of a potential cybersecurity incident involving certain information stored on a platform operated by a third-party service provider used by Baker Tilly in connection with services we provide to clients,” reads the notification to customers.”
- SupportedBaker Tilly said: “The unauthorized actor was able to obtain data relating to certain Baker Tilly clients.”BleepingComputer: ““The unauthorized actor was able to obtain data relating to certain Baker Tilly clients,” the company added.”
- SupportedBaker Tilly learned of the incident on September 6 and completed its review on October 28, identifying whose information was involved.BleepingComputer: “Baker Tilly learned of the incident on September 6 and completed its review of the affected data on October 28, when it identified whose information was involved.”
- SupportedThe breach notification gives no count of impacted clients, does not name the service provider and leaves the specific data types as a placeholder.BleepingComputer: “The breach notification does not provide a count of impacted clients, does not name the service provider, and leaves the specific data types exposed as a placeholder.”
- SupportedBaker Tilly operates in 147 countries and reports annual revenue of $6.8 billion.BleepingComputer: “Globally, the company operates in 147 countries and reports an annual revenue of $6.8 billion .”
- SupportedBaker Tilly said it took immediate steps to contain the incident, hired external experts to investigate and notified law enforcement.BleepingComputer: “After discovering the incident, the company says it took immediate steps to contain it, contracted external experts to investigate, and notified law enforcement authorities.”
- SupportedBaker Tilly said it currently has no evidence of unauthorized activity on its own network.BleepingComputer: “Furthermore, it says it currently has no evidence of unauthorized activity on its own network”
- SupportedBaker Tilly said it has no reports of identity theft or fraud linked to the exposure of customer information.BleepingComputer: “and added that it has no reports of identity theft or fraud linked to the exposure of customer information.”
- SupportedBaker Tilly is offering affected individuals 24 months of credit and identity monitoring through Experian.BleepingComputer: “To mitigate the risks arising from the incident, the firm offers affected individuals 24 months of credit and identity monitoring through Experian.”
