The Baker Tilly data breach has exposed personal information belonging to certain clients through a third-party service provider. The confirmed data theft included names, addresses and Social Security numbers, according to summaries of a Texas regulatory listing.
Baker Tilly Advisory Group, LP first disclosed the incident publicly through state breach notifications dated 9 November 2026. The available notices indicate that the compromise affected an external platform used to support services for Baker Tilly clients, rather than providing evidence of continuing access to the firm’s own network.
What happened in the Baker Tilly data breach
An unauthorised actor obtained data relating to certain Baker Tilly clients from a platform operated by an unnamed third-party service provider. Baker Tilly used this platform in connection with services it delivered to clients.
California’s breach registry records 2 September 2026 as the date of the breach. Baker Tilly said it became aware of a potential cybersecurity incident affecting the third-party platform on 6 September 2026, four days after the recorded breach date.
The firm then began an investigation with external specialists, notified law enforcement and reviewed the affected information. That review was completed on 28 October 2026 and was intended to establish whose information had been involved.
Consumer notice letters were dated and filed with the California Department of Justice and the Massachusetts Office of Consumer Affairs and Business Regulation on 9 November 2026. These documents represent the earliest public evidence currently available for the Baker Tilly data breach.
On 10 November 2026, the incident also appeared on the Texas Attorney General’s public breach list. Independent trackers referencing that listing report that 10,456 people in Texas were affected and that notices were sent by post.
Confirmed incident timeline
- 2 September 2026: The breach date recorded by the California Attorney General.
- 6 September 2026: Baker Tilly learned of a potential incident involving the third-party platform.
- 28 October 2026: The firm completed its review to identify the people and information affected.
- 9 November 2026: Consumer notices were dated and filed in California and Massachusetts.
- 10 November 2026: The Texas Attorney General listing was published, according to trackers of the state portal.
Data exposed through the third-party platform
Summaries of the Texas Attorney General record identify names, addresses and Social Security numbers among the information exposed. Social Security numbers are particularly sensitive because they are widely used in the United States to verify identity and may remain useful to criminals for extended periods.
The publicly accessible California and Massachusetts sample letters do not clearly display the line specifying the affected data fields. However, the notices confirm that an unauthorised party obtained information relating to certain clients, while the Texas summaries provide the more specific description of exposed information.
The publicly reported figure of 10,456 applies to affected Texas residents. The available filings do not provide a confirmed total for all individuals affected by the Baker Tilly data breach, so the Texas number should not be interpreted as the overall incident size.
Baker Tilly is offering affected individuals two years of Experian credit and identity monitoring. This offer indicates that the organisation considers ongoing monitoring appropriate for people whose information was included in the incident.
How the Baker Tilly data breach occurred
The compromise took place on infrastructure operated by a third-party service provider. The platform held information used by Baker Tilly Advisory Group in connection with client services, and the unauthorised actor was able to access and obtain data from it.
No vendor name, product name, software version or platform configuration has been disclosed in the available notices. It is therefore not possible to determine whether the attacker exploited a software vulnerability, used stolen credentials, abused a configuration error or entered through another route.
There is also no disclosed CVE identifier or proof of concept associated with the Baker Tilly data breach. The event should be treated as a confirmed third-party platform compromise, not as a publicly documented vulnerability affecting a named product.
The notices do not state how long the attacker had access, how the activity was detected or whether the data was compressed or transferred using particular tools. No technical indicators of compromise have been published, such as malicious IP addresses, domains, malware names, file hashes or suspicious file paths.
This lack of technical information limits the ability of other organisations to search directly for matching attacker activity. It also means that businesses should avoid assuming their systems are unaffected simply because common security tools have not generated an alert related to a named vulnerability.
Own systems versus supplier systems
Baker Tilly said it found no evidence of continued unauthorised access to its own network or systems. This wording is important because it distinguishes the affected service provider’s platform from Baker Tilly’s internal environment, while not changing the fact that client data was obtained.
The affected entity named in the regulatory filings is Baker Tilly Advisory Group, LP. It operates alongside Baker Tilly US, LLP under an alternative practice structure, but the notices specifically identify the Advisory Group entity.
Current exploitation and attribution status
Data theft is confirmed. An unauthorised actor accessed the external platform and obtained information relating to certain clients, making this more than an attempted intrusion or precautionary disclosure.
However, the official notices do not attribute the Baker Tilly data breach to a named criminal group or state-linked actor. They also do not report publication of the stolen information, an extortion demand or further in-the-wild exploitation following the original compromise.
There is no public evidence in the reviewed notices of continuing access to Baker Tilly’s systems. Law enforcement has been notified, but no related arrests, infrastructure seizures or attacker identification have been disclosed.
Why the incident matters to UK organisations
The known impact is primarily US facing because the exposed records include Social Security numbers and the notifications were filed with US state authorities. Nevertheless, UK businesses may still have exposure if they use relevant Baker Tilly network services, operate in the United States or transfer employee, customer or corporate data to the affected US entity.
The Baker Tilly data breach also demonstrates how information can be compromised at a service provider even when there is no evidence of continued access to the contracting organisation’s own network. Data location and supplier access are therefore central to understanding actual exposure.
What potentially affected organisations should do
Organisations with a relevant Baker Tilly relationship should seek written confirmation of whether their information was stored or processed on the affected platform. Requests should reference the incident dated 2 September 2026 and ask what records, individuals and legal entities were in scope.
- Confirm whether data was shared with Baker Tilly Advisory Group, LP or the unnamed platform provider.
- Identify affected US employees, customers or other individuals who may require support.
- Review cross-border data flows and records showing which suppliers hold sensitive identity information.
- Preserve correspondence and notification records for legal, insurance and regulatory review.
- Direct notified individuals to the official Experian monitoring enrolment information supplied by Baker Tilly.
Because no technical indicators or affected product details have been released, the immediate priority is data mapping and direct supplier confirmation. Organisations should base their response on verified scope information rather than speculation about the attack method.
Originally reported by Claim Depot.
