Baker Tilly Data Breach: Client Information Exposed Through Third Party Provider

Accounting and advisory firms handle some of the most sensitive information belonging to individuals and businesses. From tax records and financial information to Social Security numbers and home addresses, these organizations are trusted to protect data that is highly valuable to cybercriminals. A newly disclosed data breach involving Baker Tilly Advisory Group shows how that sensitive information can be exposed even when an organization relies on an outside technology provider.

On November 11, 2026, BleepingComputer reported that Baker Tilly was notifying clients about unauthorized access to information stored on a platform operated by an unnamed third-party service provider. According to regulatory filings, the incident affected at least 10,456 individuals in Texas, with exposed information including names, addresses, Social Security numbers, and other personal information.

Baker Tilly has not publicly identified the affected provider or disclosed the technical method used in the attack, and the company reported that it had not identified evidence of unauthorized activity on its own network. The incident highlights a cybersecurity concern for businesses of every size: sensitive information can be compromised through a trusted service provider, even when the primary organization's own systems have not been confirmed as breached.

What happened in the Baker Tilly data breach?

Baker Tilly Advisory Group is a major accounting and advisory organization providing tax, consulting, compliance, and other professional services. Like many firms, it uses external technology providers to support some of its client services. According to its breach notification, an unauthorized actor obtained information relating to certain Baker Tilly clients from a platform operated by one of those providers.

Baker Tilly became aware of the potential incident on September 6, 2026, and began an investigation with external cybersecurity experts to determine its nature and scope. On October 28, 2026, the company completed its review of the affected information and identified the individuals whose information was involved. Notification letters dated November 9 were then issued to affected individuals, and the incident became the subject of broader public reporting on November 11.

Baker Tilly breach timeline

• September 2, 2026: the incident date listed in California's breach-reporting records.
• September 6, 2026: Baker Tilly became aware of the potential cybersecurity incident.
• October 28, 2026: the company completed its review of the affected information.
• November 9, 2026: breach notification letters were dated and California recorded the notification.
• November 11, 2026: BleepingComputer published details of the incident.

The investigation has not publicly established the initial intrusion method or the identity of the attackers.

What information was exposed?

The exposed information varies by individual. According to information reported by the Texas Attorney General's Office, the incident involved personal information including full names, residential addresses, Social Security numbers, and other personal information. Baker Tilly's notification also indicates that information belonging to certain clients' dependents was affected.

The publicly available sample notification does not provide a complete individualized inventory of what was exposed. Importantly, the company has not confirmed that login passwords, authentication tokens, banking credentials, or other account-access secrets were stolen. That distinction matters, because exposure of personal identifying information creates different risks from the theft of authentication credentials, and it points to a different response, as we explain further below.

How many people were affected?

The Texas Attorney General's reporting indicates that 10,456 Texas residents were affected, and additional breach notifications have been filed in other states. The Texas figure should not be read as the total number of people affected nationwide. Baker Tilly's publicly reviewed notification did not establish a comprehensive national total, and the final scope may become clearer as more regulatory information or company updates appear. Businesses and individuals should rely on official notifications rather than assuming everyone who has used Baker Tilly's services was affected.

Was Baker Tilly's own network compromised?

Baker Tilly stated that it found no evidence of unauthorized activity on its own network or systems. The confirmed incident instead involved information stored on a platform operated by an external service provider. That does not make the incident harmless. A service provider may hold sensitive information on behalf of many organizations, so when attackers reach such a platform, they can obtain information belonging to customers who have no direct relationship with the provider.

The precise security weakness involved here has not been disclosed. There is currently no verified evidence that phishing, stolen employee passwords, malware, or a software vulnerability caused the breach. Those are potential causes of third-party incidents in general, not confirmed explanations for this one. It is the same pattern behind other recent vendor incidents, such as the Chainstack and DreamHost breaches: your data can be exposed through a provider even when your own systems are fine.

Why Social Security number exposure is serious

Social Security numbers are sensitive identifiers that can create long-term identity-theft risk when combined with other personal information. An attacker who holds a person's name, address, and Social Security number may try to misuse that information for fraudulent applications, impersonation, or other identity-related schemes. Unlike a password, a Social Security number cannot simply be replaced through an ordinary account-security process, which is why protective measures such as credit monitoring and credit freezes matter so much.

That said, the exposure of Social Security numbers does not establish that identity theft has occurred. Baker Tilly stated that it was not aware of identity theft or fraud resulting from the incident at the time of its notification. The right posture is to treat the exposure as a reason to put protections in place, not as proof that harm has already happened.

What is Baker Tilly doing in response?

According to its notification, Baker Tilly took steps to contain the incident, engaged outside cybersecurity experts to investigate, and notified law enforcement. To assist affected individuals, it is offering 24 months of complimentary credit and identity monitoring services through Experian. Affected individuals should review their notification letters for enrollment instructions and any applicable deadlines. The company has not publicly identified the third-party provider involved or disclosed a complete technical account of the intrusion.

What should affected Baker Tilly clients do?

Individuals who receive a breach notification should take steps appropriate to the type of information involved.

1. Review your official notification. Read it carefully to see what information Baker Tilly identified as affected, and do not assume everyone experienced the same exposure. If you are unsure a communication is legitimate, contact Baker Tilly through an independently verified channel.
2. Enroll in available identity monitoring. Consider the 24 months of complimentary Experian credit and identity monitoring, following the instructions in the official notification rather than links in unsolicited messages.
3. Consider freezing your credit. A credit freeze helps prevent unauthorized new credit accounts from being opened in your name. In the United States, consumers can request free freezes through Equifax, Experian, and TransUnion. It does not prevent every form of identity theft, but it is meaningful protection against new-account fraud.
4. Monitor financial activity. Review bank statements, credit reports, and other financial records for unfamiliar activity, and report suspicious transactions to the relevant institution.
5. Watch for impersonation attempts. Criminals use exposed personal information to make fraudulent messages convincing. Someone claiming to represent an accounting firm might cite your name or address before requesting more information. Treat unexpected requests for payment, authentication codes, or sensitive financial details with caution, and see our guide to spotting phishing emails.
6. Protect important online accounts. Use unique passwords and enable multifactor authentication for email, financial services, and other sensitive accounts. Passwords have not been confirmed as exposed here, but these measures remain important for general security.
7. Consider additional identity protection. If your Social Security number was exposed, review identity-theft prevention resources from the Federal Trade Commission, and consider an IRS Identity Protection PIN to help guard against fraudulent federal income-tax filings.

What small businesses can learn from the Baker Tilly incident

The breach is a clear reminder to understand how external providers handle sensitive information. Small businesses regularly share information with accountants, payroll companies, insurers, cloud platforms, and other providers. Those relationships are essential, but each one is another place sensitive data may be stored.

• Know which vendors hold sensitive information. Keep an inventory of providers that store or process confidential data, noting the type of information shared and why it is retained.
• Limit unnecessary data sharing. Provide only what a vendor genuinely needs, and avoid retaining or distributing sensitive records longer than necessary.
• Review vendor security practices. Before engaging a provider, ask how sensitive information is protected, who can access it, and how the provider manages its own subcontractors.
• Establish breach-notification expectations. Vendor agreements should define incident-reporting responsibilities and notification procedures, so you know who will contact you if your information is compromised.
• Maintain an incident response process. When a vendor reports a breach, assess whether employee, customer, or business information was affected, and respond accordingly, including notifying affected parties and consulting legal advisers.
• Train employees to recognize impersonation. Breaches hand criminals the personal details that make fraudulent emails and calls persuasive, so staff should independently verify unexpected requests involving payments, sensitive documents, or account changes.

Accounting firms in particular are high-value targets for exactly this reason, which is why we cover the topic in depth in our guide to dark web monitoring for accounting firms.

How personal information exposure differs from credential theft

Not every data breach involves stolen passwords. In the Baker Tilly incident, the confirmed exposure concerns personal identifying information, and there has been no verified disclosure that login credentials were stolen. Credential theft involves information that can directly enable unauthorized account access, such as passwords or certain authentication secrets. Personal-information exposure instead creates risks around identity theft, impersonation, and targeted scams.

Some incidents involve both categories, but one does not automatically mean the other occurred, and the distinction guides the right response. Credit freezes and identity monitoring address the risks tied to Social Security number exposure. Password resets, multifactor authentication, and account-activity reviews are what matter when authentication credentials may have been compromised. Knowing which kind of exposure you are dealing with keeps you from wasting effort on the wrong defense, which is also why ongoing dark web monitoring is useful: it tells you specifically when a login, not just personal data, has surfaced.

How GuardPilot supports credential exposure awareness

GuardPilot helps individuals and small businesses identify known exposed login credentials appearing in supported breach records, infostealer data, and dark-web sources. When relevant findings are available, GuardPilot uses AI to explain the exposure, provide context about potential risks, and guide users through recommended remediation steps. That is the difference from alert-only tools: GuardPilot turns a finding into a handled incident rather than a list you are left to decipher.

The boundary is equally important. GuardPilot does not investigate Baker Tilly's systems, scan third-party provider infrastructure, or determine whether a person's Social Security number was included in this incident. It also cannot confirm whether Baker Tilly client passwords were compromised when no such exposure has been verified. A clean credential-exposure result does not mean someone was unaffected by the Baker Tilly breach, and individuals receiving official notifications should follow the identity-protection guidance provided regardless of any monitoring result. For businesses concerned about known exposed employee login credentials, GuardPilot complements other security and identity-protection measures. Check for known business credential exposures.

Frequently asked questions

Was Baker Tilly hacked in 2026?

Baker Tilly confirmed that an unauthorized actor obtained certain client information from a platform operated by a third-party service provider. The company reported no evidence of unauthorized activity on its own network.

When did the Baker Tilly breach happen?

California's regulatory records list September 2, 2026, as the incident date. Baker Tilly became aware of the potential incident on September 6.

How many people were affected?

Texas reporting identifies 10,456 affected residents. The complete nationwide total has not been established in the reviewed company notification.

Were Social Security numbers exposed?

Yes. Texas regulatory reporting lists Social Security numbers among the categories of affected information.

Were Baker Tilly passwords stolen?

There is no verified public disclosure confirming that passwords or authentication tokens were stolen.

Was ransomware involved?

The available reporting does not establish that ransomware was involved. The attackers' identity and the technical intrusion method have not been publicly confirmed.

The takeaway

The Baker Tilly data breach shows that sensitive information can be exposed through a trusted provider even when a firm's own network is not confirmed as compromised. Because the confirmed exposure involves personal identifying information including Social Security numbers, the most relevant protections are credit freezes, identity monitoring, watchfulness for impersonation, and reliance on official notifications rather than assumptions. For businesses, the lasting lesson is to know which vendors hold your sensitive data, limit what you share, set clear breach-notification expectations, and treat a provider's incident as your own to respond to.