The Baker Tilly Advisory Group is notifying clients that a data breach has compromised certain personal information about them and their dependents.

The company said the exposed data was stored on a platform operated by a third-party service provider Baker Tilly uses to serve clients.

Baker Tilly learned of the incident on September 6 and completed its review of the affected data on October 28, when it identified whose information was involved.

“On September 6, 2026, Baker Tilly became aware of a potential cybersecurity incident involving certain information stored on a platform operated by a third-party service provider used by Baker Tilly in connection with services we provide to clients,” reads the notification to customers.

“The unauthorized actor was able to obtain data relating to certain Baker Tilly clients,” the company added.

The breach notification does not provide a count of impacted clients, does not name the service provider, and leaves the specific data types exposed as a placeholder.

Data from the Office of the Texas Attorney General reports that Baker Tilly impacted 10,456 individuals in the state of Texas alone. The portal lists Social Security numbers (SSNs), full names, addresses, and other information as exposed data types.

Baker Tilly is a major accounting firm in the U.S., providing auditing, tax planning, compliance, advisory, and business operations services. Globally, the company operates in 147 countries and reports an annual revenue of $6.8 billion.

After discovering the incident, the company says it took immediate steps to contain it, contracted external experts to investigate, and notified law enforcement authorities.

Furthermore, it says it currently has no evidence of unauthorized activity on its own network, and added that it has no reports of identity theft or fraud linked to the exposure of customer information.

To mitigate the risks arising from the incident, the firm offers affected individuals 24 months of credit and identity monitoring through Experian.

BleepingComputer has contacted Baker Tilly for more information about the data breach, its source, the number of affected customers, and the type of data compromised, but we have not received a reply by the time of publishing.

BleepingComputer did not find any announcements from ransomware groups claiming the attack.

Uncover email threats your existing defenses may miss.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.

Start your free email security scan.