Accounting Firm Baker Tilly Tells Clients Their Data Was Taken From an Outside Provider’s Platform; Texas Filing Lists More Than 10,000 Residents
Baker Tilly is notifying clients that an unauthorized party obtained personal information about them and their dependents from a platform run by a third-party service provider. A Texas Attorney General listing counts 10,456 affected Texans, with Social Security numbers among the data.
When a business hands its books to an accounting firm, it is trusting that firm with some of the most sensitive information it has: owners’ and employees’ Social Security numbers, home addresses, dependents and financial details. This week, clients of one of the largest U.S. accounting firms learned that some of that information was taken, not from the firm itself but from a service it relied on.
The account below is based on BleepingComputer’s report on the Baker Tilly notification.
How the incident came to light
Baker Tilly, which provides audit, tax, compliance and advisory services and reports operating in 147 countries, says it became aware of a potential cybersecurity incident on September 6, 2026. The affected information was stored on a platform operated by a third-party service provider that the firm uses to deliver services to clients. According to the firm’s notice, an unauthorized actor was able to obtain data relating to certain Baker Tilly clients and their dependents.
It took until October 28 for the firm to finish reviewing the affected data and identify whose information was involved. Notification letters followed.
What the notice leaves out
The letter is notable for what it does not say. It does not name the service provider, does not give a total number of affected clients, and, in the copy BleepingComputer reviewed, the section describing the types of exposed data contained only a placeholder. BleepingComputer asked the firm for those details and had not received a reply by publication. It also found no ransomware group publicly claiming the attack.
A clearer picture comes from a state filing. The Office of the Texas Attorney General lists 10,456 affected Texans and names Social Security numbers, full names and addresses among the data involved. Because that figure covers only one state, the total is likely higher, though the firm has not confirmed it.
How the firm responded
Baker Tilly says it moved to contain the incident, brought in outside experts to investigate and notified law enforcement. It says it has found no evidence of unauthorized activity on its own network and has received no reports of identity theft or fraud tied to the incident. Affected individuals are being offered 24 months of credit and identity monitoring through Experian.
Part of a familiar pattern
Breaches that happen at a vendor’s platform rather than at the company whose name is on the letter have become one of the most common ways client data leaks. The firm that holds the relationship may have strong controls of its own and still be exposed through a portal, file-sharing service or processing tool run by someone else.
What this means for your company
If you receive a letter like this, take the monitoring offer, consider freezing your credit with the three bureaus, and watch for tax-related fraud, since Social Security numbers combined with tax-season timing are a common target. Be cautious of follow-up calls or emails that reference the breach and ask you to confirm personal details. On the business side, it is a good time to ask your accountant, payroll provider and other advisers which outside platforms hold your information, how access to those platforms is protected, and how quickly they would tell you if one were breached. Keep a simple list of the vendors that hold your sensitive data so you can act fast when a notice arrives.
Want help mapping which outside providers hold your company’s sensitive data and how well it is protected? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
