Baker Tilly Advisory Group, a large US accounting, tax and advisory firm, is notifying clients that a data breach exposed personal information about them and their dependents. BleepingComputer, which reported the news from the firm’s notification letter, says the data sat on a platform run by a third-party service provider that Baker Tilly uses to serve clients. Baker Tilly says it learned of a potential incident on September 6, 2026 and finished reviewing the affected data on October 28, when it identified whose information was involved. “The unauthorized actor was able to obtain data relating to certain Baker Tilly clients,” the letter says.
The letter does not say how many people were affected, does not name the provider and leaves the list of exposed data types as an unfilled placeholder. BleepingComputer points to a filing on the Texas Attorney General’s portal that reports 10,456 affected Texans and lists Social Security numbers, full names, addresses and other information. Baker Tilly says it has no evidence of unauthorized activity on its own network and no reports of identity theft or fraud tied to the exposure. It notified law enforcement and hired outside experts, and it offers affected people 24 months of credit and identity monitoring through Experian. BleepingComputer says it asked Baker Tilly for the count, the source and the data types, had no reply at publication, and found no ransomware group claiming the attack.
How to check if you’re affected
Affected products and services here are Baker Tilly’s client services, and the people affected are clients and their dependents; the firm says it is notifying clients. Based on the letter and the Texas filing as BleepingComputer reports them:
- If you or a family member received a Baker Tilly notice, the letter is the firm’s confirmation that your data was involved. The notice BleepingComputer linked is a sample individual letter; the page returned only its title when we fetched it, so we have not read its text directly.
- The Texas filing lists Social Security numbers among the data types, so treat the exposure as including SSNs for Texas residents at least; the letter itself leaves the types blank, so the firm’s full list for other states is unknown.
- Use the 24 months of Experian credit and identity monitoring if you are offered it. Our suggestion, not Baker Tilly’s: also consider a credit freeze, which blocks new accounts opened in your name, and be wary of unexpected messages that mention Baker Tilly or your tax and financial details.
If you are a Baker Tilly client but received no letter, the sources do not say who else may be affected or whether more notices will follow.