Accounting and advisory firm Baker Tilly has begun notifying clients after an unauthorized party obtained personal information from a third-party service provider. The incident affected records belonging to clients and their dependents, including Social Security numbers and other identifying information.
Baker Tilly became aware of the suspected breach on September 6, 2026. Its investigation determined that an attacker had accessed data stored on an external platform used to deliver services to the firm’s clients. According to regulatory records, the unauthorized activity occurred on September 2.
The company launched an investigation with assistance from external cybersecurity specialists. After examining the affected information, Baker Tilly completed its review on October 28 and began identifying the individuals whose records had been compromised.
The precise number of people affected nationwide remains undisclosed. However, a filing with the Texas Attorney General’s Office identifies 10,456 affected residents in that state alone. Separate notifications indicate that individuals in other states were also impacted.
The Texas filing identifies names, residential addresses, Social Security numbers, and additional personal information among the compromised records. The specific categories of exposed information may differ between individuals.
Some notifications were addressed to parents or guardians, confirming that the incident also involved information belonging to minors. The company has not publicly provided a complete breakdown of affected adults and children.
Baker Tilly has not identified the service provider responsible for hosting the compromised information. It has also not disclosed how the attacker entered the platform, how long access was maintained, or whether a particular software vulnerability contributed to the intrusion.
The firm emphasized that its investigation has found no evidence of continued unauthorized access to its own network or systems. The available findings indicate that the exposure originated from the external service provider rather than a confirmed compromise of Baker Tilly’s internal infrastructure.
After discovering the incident, the company took containment measures, engaged outside investigators, and notified law enforcement authorities. It began sending notification letters to affected individuals on November 9.
Baker Tilly said it had received no reports of identity theft or financial fraud directly associated with the exposed information. However, the absence of reported misuse does not establish that the stolen records have been destroyed or are no longer accessible to the attacker.
To address potential identity theft risks, the firm is offering affected individuals 24 months of complimentary credit and identity monitoring through Experian IdentityWorks. The assistance is also available to affected minors through the appropriate enrollment process.
The company has established a dedicated telephone support line for individuals seeking information about the incident and the monitoring services.
No ransomware organization has publicly established responsibility for the breach, and the identity of the attacker remains unknown. Baker Tilly has not disclosed whether the compromised service provider serves other organizations that may have been affected.