Baker Tilly Advisory Group, one of the largest accounting and advisory firms in the United States, is notifying clients that a data breach has exposed their personal information, including Social Security numbers. The data was held not on Baker Tilly's own systems but on a platform run by a third-party service provider the firm uses to serve its clients.

The firm became aware of the incident on 6 September 2026 and spent almost eight weeks reviewing the affected data before identifying whose information was involved. That review was completed on 28 October, and notification letters to affected individuals are dated 9 November. News of the breach became public on 11 November.

What happened

In its notification to customers, Baker Tilly said an unauthorised actor was able to obtain data relating to certain clients from the provider's platform. The company said it moved immediately to contain the incident, brought in outside experts to investigate, and notified law enforcement.

Baker Tilly has not named the third-party provider, has not said how the attacker got into the platform, and has not disclosed a total number of people affected. The sample notification letter seen by reporters leaves the specific data types exposed as a placeholder, with each individual letter expected to list that person's own information.

The firm said it currently has no evidence of unauthorised activity on its own network, and no reports of identity theft or fraud linked to the exposure. BleepingComputer, which first reported the breach, said it found no claims of responsibility from any ransomware group.

How many people are affected

While Baker Tilly has not published a total, filings with state regulators give a partial picture. The Office of the Texas Attorney General reports that 10,456 people in Texas were affected, and lists Social Security numbers, full names, addresses and other information among the data exposed. State filings also list 2,689 people in Massachusetts and more than 500 in California.

California requires a report when a single breach affects more than 500 of its residents, which suggests the true total across all states is higher than the figures published so far. The firm has been contacted for more detail about the number of people affected and the data involved but had not replied by the time the breach was reported.

What Baker Tilly is doing

The firm is offering affected individuals 24 months of credit and identity monitoring through Experian at no cost. Anyone who receives a letter is being advised to take up the offer and to watch their accounts and credit reports for unusual activity.

People who receive a notice should also be wary of follow-up messages. Criminals often use news of a breach to send phishing emails or make calls asking victims to confirm personal details. Baker Tilly clients should not share Social Security numbers, bank details or passwords in response to an unexpected message, and should contact the firm through its published channels if they are unsure whether a message is genuine.

Baker Tilly is a major US accounting firm providing auditing, tax planning, compliance and advisory services. Globally, the Baker Tilly International network operates in 147 countries and reports annual revenue of 6.8 billion dollars. The breach is a reminder that sensitive client data can be exposed through a supplier's systems even when a firm's own network is not breached, and that third-party risk remains one of the hardest problems in corporate cybersecurity.