Breach · 4 min read
Baker Tilly tells clients a vendor’s platform leaked their data, with SSNs in Texas filings
The US accounting and advisory firm says an intruder took client data from a third-party provider’s platform. Texas records list 10,456 people and Social Security numbers. Monitoring is offered.
Baker Tilly Advisory Group, one of the largest accounting and advisory firms in the United States, has started notifying clients that some of their personal information, and in some cases their dependents’ information, was taken from a platform run by one of its service providers. Its sample letter, filed with the California Attorney General and dated November 9, 2026, describes what happened. BleepingComputer reported the notices on November 11. Here’s what the letter says, what it leaves out, and what to do if you get one.
What Baker Tilly says happened
According to the letter:
- September 2, 2026: the date of the breach listed in the California filing.
- September 6: Baker Tilly became aware of a potential cybersecurity incident involving information stored on a platform operated by a third-party service provider it uses to serve clients.
- The intruder was able to obtain data relating to certain Baker Tilly clients.
- October 28: Baker Tilly finished reviewing the affected data and worked out whose information was involved.
- November 9: the date on the sample notice letter.
Baker Tilly says it contained the incident, brought in outside experts and notified law enforcement, and that it has found no evidence of continued unauthorized access to its own network or systems. It says it isn’t aware of identity theft or fraud linked to the incident and that it believes the information “will not be misused or sold.” It doesn’t explain why it believes that.
What the letter leaves out
The sample letter doesn’t name the service provider or say how the platform was reached. The list of data types is a placeholder that each person’s letter fills in, so the sample doesn’t show what was taken. It also doesn’t give a total number of people affected.
BleepingComputer found that the Office of the Texas Attorney General lists 10,456 affected Texans, with Social Security numbers, full names, addresses and other information among the data types. That’s one state, so the full total is likely higher. BleepingComputer says it found no ransomware group claiming the attack.
What Baker Tilly is offering
Baker Tilly is offering two years of credit and identity monitoring through Experian at no cost. Questions go to its call centre at 833-918-3966, Monday to Friday, 8 AM to 8 PM Central Time, and you’ll be asked for the engagement number printed on your letter.
What this means for you
Accounting and tax firms hold some of the most sensitive records people have: Social Security numbers for you and your dependents, addresses, and often income details. A name, address and SSN together are enough to try opening credit or filing a fraudulent tax return in your name. They also make phishing and phone scams that mention “your tax documents” much more believable.
What you can do
- Read your letter closely. It lists the specific types of your information that were involved. Keep it, along with the engagement number.
- Enroll in the Experian monitoring using the code in your letter, not a link from an unexpected email.
- Freeze your credit with Equifax, Experian and TransUnion. A freeze is free in the US and stops new accounts being opened in your name. Do it for dependents named in the letter too.
- Get an IRS Identity Protection PIN. The IRS IP PIN stops someone else filing a tax return with your SSN.
- Be wary of calls or emails about your tax file that ask you to confirm your SSN, banking details or a login. Call Baker Tilly or your usual contact on a number you already have.
How Frame helps
Baker Tilly hasn’t published a list of affected email addresses, so there isn’t a breach record to add in Frame yet. If you received a letter, add the breach to a verified email in Frame for a short checklist of what to do. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.
Related coverage
- Who Gives A Crap says a marketing provider exposed customer names and addresses: another breach that happened at a provider rather than the company people dealt with.
- Front Systems breach reaches shoppers at Norwegian clothing chains: a software supplier’s breach this week that also reached its clients’ customers.
Sources
- California Attorney General, Submitted breach notification sample: Baker Tilly Advisory Group, LP, with the sample individual notice (PDF), November 2026
- BleepingComputer, Baker Tilly notifies clients of data breach at third-party provider, November 11, 2026
More stories
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.