Baker Tilly Advisory Group has disclosed a third-party data breach affecting 195,512 individuals, including clients and some dependents. The compromised information includes names, addresses, Social Security numbers and other sensitive personal data. The incident highlights growing cybersecurity risks associated with third-party service providers and the potential for long-term identity theft.
WHAT BAKER TILLY CONFIRMED
Baker Tilly discovered the cybersecurity incident on September 6, 2026, after an unauthorized actor obtained client-related information stored on an unnamed third-party platform. The company completed its investigation on October 28 and began issuing notification letters on November 9. Regulatory filings confirmed that 195,512 individuals were affected nationwide, including 10,456 Texas residents, 2,689 Massachusetts residents and 1,359 South Carolina residents. The specific information exposed varies by individual.
WHAT REMAINS UNKNOWN
Baker Tilly has not identified the third-party provider, compromised platform or attack method. No public evidence connects the incident to ransomware, extortion or a known threat actor. The company reported no evidence of continued unauthorized access to its internal systems or confirmed identity fraud involving the stolen information. However, exposed Social Security numbers could remain valuable to cybercriminals for years.
BAKER TILLY’S RESPONSE AND IDENTITY PROTECTION
Baker Tilly contained the incident, engaged cybersecurity specialists and notified law enforcement. Affected individuals are being offered 24 months of Experian IdentityWorks monitoring and identity-restoration services. Recipients should independently verify notifications, consider freezing their credit files with the three major credit bureaus and monitor financial accounts for suspicious activity. Individuals may also obtain an IRS Identity Protection PIN to reduce the risk of fraudulent tax filings.
DEFENDER IMPLICATIONS
The breach underscores the importance of third-party risk management, vendor security assessments and data-minimization practices. Organizations should evaluate external providers handling sensitive information, enforce strict access controls and establish timely breach-notification requirements. Security teams should also monitor phishing campaigns impersonating Baker Tilly or identity-monitoring providers. The incident demonstrates how compromised vendor environments can expose substantial amounts of personal information even when an organization’s internal network remains unaffected.