Baker Tilly: third-party provider breach exposes client SSNs and personal data
Severity: medium · Patch status: no-fix-needed · Since 2026-11-11
Baker Tilly, a major US accounting and advisory firm, is notifying clients that an unauthorized actor obtained client data stored on a platform operated by an unnamed third-party service provider. The firm learned of the incident on September 6, 2026, and completed its review on October 28, identifying affected individuals and dependents. Texas AG filings report 10,456 impacted individuals in Texas alone, with exposed data including Social Security numbers, full names, addresses, and other information. Baker Tilly says it contained the incident, engaged external forensic experts, notified law enforcement, and found no evidence of unauthorized activity on its own network or reports of identity theft. It is offering 24 months of Experian credit and identity monitoring. No ransomware group has claimed the attack.
What to do
- If notified by Baker Tilly, enroll in the offered Experian credit/identity monitoring and place fraud alerts or credit freezes
- Monitor financial accounts, credit reports, and IRS/tax filings for fraudulent activity given SSN exposure
- Review third-party vendor risk and data-sharing agreements for providers holding sensitive client data
- Verify no unauthorized activity on your own Baker Tilly-related accounts and communications
Sources
All live incidents on Threat Watch
