The advisory makes two plain points: certain personal information belonging to Baker Tilly clients and their dependents was exposed, and that data resided on a platform run by a third‑party service provider. Beyond those phrases the company’s public message is thin — it does not name the vendor, does not provide a total count of impacted clients, and left the specific data types in the notification itself as a placeholder. Where public record fills the gap, the scale is substantial: the Office of the Texas Attorney General shows 10,456 individuals in Texas listed as impacted, with exposed data types on the portal including Social Security numbers, full names, addresses, and other information.
Baker Tilly’s timeline and immediate steps
Baker Tilly says it first learned of the incident on September 6, 2026, and completed its review of affected data on October 28, 2026, when it identified whose information was involved. According to the firm, it took immediate steps to contain the incident, engaged external experts to investigate, and notified law enforcement authorities. The company also stated it currently has no evidence of unauthorized activity on its own network and reported no known instances of identity theft or fraud linked to the exposure.
What was exposed and how we know
The firm’s notification describes an “unauthorized actor” obtaining data “relating to certain Baker Tilly clients.” Baker Tilly’s public notice omits a detailed inventory; however, the Office of the Texas Attorney General’s portal lists 10,456 Texas individuals as affected and identifies Social Security numbers, full names, addresses, and other information as exposed data types. The contrast between the placeholder language in Baker Tilly’s own notice and the Texas filing is a clear example of how state breach reporting can reveal granular detail not always present in corporate advisories.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadThird‑party platform and attribution
Baker Tilly says the exposed information was stored on a platform operated by a third‑party service provider it uses to serve clients. The company did not name that provider in its notice. Independent reporting by BleepingComputer found no public claim of responsibility from known ransomware groups, and BleepingComputer had reached out to Baker Tilly for further information — including the identity of the service provider, the number of affected customers, and the specific data types compromised — but had not received a reply by the time of publication.
Response measures for clients, regulators, and security teams
- Clients and dependents: Baker Tilly is offering affected individuals 24 months of credit and identity monitoring through Experian. Clients who received the notification should review communications from the firm and the Experian offer for steps to enroll.
- Regulators: The Office of the Texas Attorney General has recorded a large number of affected individuals in Texas (10,456), including listed data types. State breach filings are the public trail where some of the missing details from corporate notices can appear.
- Security teams and procurement leaders: The incident underscores a concrete risk tied to data stored on platforms run by third‑party providers; Baker Tilly’s account notes the exposure occurred on such a platform and that external forensic experts were contracted to investigate. Teams responsible for vendor risk management will likely treat this case as a prompt to review contractual and technical controls governing client data hosted on third‑party platforms.
Baker Tilly is a major accounting firm operating in 147 countries with reported annual revenue of $6.8 billion. That scale — global reach combined with client data stored on a third‑party platform — helps explain why state filings, external investigators, and monitored services are likely to remain the primary sources of new public detail. For now, the record is clear about dates, the existence of an unauthorized access to third‑party‑hosted client records, and steps the firm says it has taken: containment, outside investigation, law enforcement notification, and an offer of Experian monitoring for affected people. What remains unresolved in public filings is the identity of the third‑party provider, the full scope of impacted customers beyond the Texas figure, and whether additional evidence will surface linking the incident to a particular tactic, technique, or extortion group.
Link to the original BleepingComputer story: https://www.bleepingcomputer.com/news/security/baker-tilly-notifies-clients-of-data-breach-at-third-party-provider/
