Baker Tilly reports client data breach at third-party provider

Baker Tilly Advisory Group says a cybersecurity incident at a third-party service provider exposed information relating to some of its clients and their dependents. The company uses the provider’s platform to deliver client services.

Baker Tilly said it learned of a potential incident on September 6, 2026, and completed a review of affected data on October 28, 2026. It said an unauthorized actor obtained data about certain clients. The company has not named the provider or specified the exposed data types in its notification, and it did not give a total number of affected clients.

Separately, records from the Texas Attorney General’s Office report that 10,456 people in Texas were affected. The state portal lists Social Security numbers, full names, addresses, and other information among the exposed data types.

Baker Tilly says it took steps to contain the incident, hired outside experts to investigate, and notified law enforcement. It said it has no evidence of unauthorized activity on its own network and has received no reports of identity theft or fraud linked to the exposure. The firm is offering affected individuals 24 months of credit and identity monitoring through Experian.

BleepingComputer said it contacted Baker Tilly for further details but had received no response by publication time.