Follow us on Google News
Personal information belonging to clients of the major U.S. accounting and advisory firm Baker Tilly, including their dependents, has been exposed following a data breach at a third-party service provider. According to filings with the Texas Attorney General’s office, 10,456 individuals in Texas alone were affected by the incident. The compromised records include sensitive details such as Social Security numbers, full names, residential addresses, and other personal data. Baker Tilly stated that it first learned of the potential cybersecurity incident on September 6, 2026, and completed its review and identification of affected individuals on October 28. While the firm has begun notifying impacted clients, its public notice did not disclose the total number of affected customers nationwide or the name of the external vendor involved.
Data Exposure on External Platform
In the notification sent to clients, Baker Tilly explained that the breach occurred on a platform operated by an outside service provider used to deliver various client services. An unauthorized party gained access to files stored on that external system and obtained data related to certain Baker Tilly customers. The publicly released client notice did not specify the exact categories of data taken or the overall count of directly impacted clients. However, records submitted to the Texas Attorney General’s office provided clearer insight into the scope of the breach, confirming the exposure of Social Security numbers, names, and home addresses for more than ten thousand residents in the state. Because Social Security numbers are central to personal identification and financial verification in the United States, the leak carries potential risks of identity theft and financial fraud.
Investigation and Client Support Measures
Upon discovering the incident, Baker Tilly moved to contain the security issue, brought in external cybersecurity specialists to investigate, and notified relevant authorities. The firm emphasized that it has found no evidence of unauthorized activity within its own internal network. Management also stated that it has not received any reports of identity theft or fraudulent misuse stemming from the exposed information so far. Nevertheless, because stolen personal details can be exploited long after an initial breach to open fraudulent accounts or conduct targeted scams, Baker Tilly is offering 24 months of complimentary credit and identity monitoring services through Experian to affected individuals to help them track suspicious activity.
Scrutiny Over Third-Party Data Security
As one of the leading accounting and advisory firms in the United States, Baker Tilly provides auditing, tax planning, regulatory compliance, consulting, and business operations services across 147 countries, generating reported annual revenues of 6.8 billion dollars. Given its extensive international footprint, safeguarding client records remains a critical operational responsibility. The fact that the compromised information was housed on an external vendor’s platform rather than Baker Tilly’s internal systems has raised broader questions regarding third-party vendor oversight and data protection standards. Requests for additional details regarding the source of the breach, the total number of affected clients, and the full extent of the stolen data have not yet been answered by the company, and no ransomware group has claimed responsibility for the attack. While it remains unclear whether the unauthorized party has misused the obtained records, the full scale and long-term impact of the incident are still being assessed.
