Baker Tilly Advisory Group is notifying some clients and their dependents after an unauthorized actor obtained personal information stored on a platform operated by an unnamed third-party service provider, according to a sample notice filed with South Carolina regulators. The provider was used in connection with services Baker Tilly delivers to clients.
The firm said it became aware of the incident on September 6, 2026, and completed its review of affected data on October 28. The notice, dated November 9, says Baker Tilly took steps to contain the incident, brought in outside experts and notified law enforcement. It also says the company has found no evidence of continued unauthorized access to its network or systems.
A Texas Attorney General filing lists 10,456 Texas residents as affected and identifies names, addresses, Social Security numbers and other information as involved. South Carolina’s official breach-notice register lists 1,359 affected residents. These are state-level counts; Baker Tilly’s sample notice does not disclose an overall total.
The sample notice offers affected individuals two years of credit and identity monitoring through Experian. It says Baker Tilly is not aware of identity theft or fraud related to the incident. The notice does not identify the provider or explain how the attacker obtained access, unlike the disclosures in Notion’s Fireworks-related AI transcript exposure and Railway’s infrastructure breach, which described their respective service providers and attack paths.
The sample notice leaves the specific data categories as a placeholder, while the Texas filing provides additional detail. BleepingComputer reported the disclosure on November 11, citing the company’s notification and the Texas Attorney General’s records.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Baker Tilly Reports Client Data Breach at Third-Party Provider
