Baker Tilly data breach letter: client data taken from a third-party provider's platform in September 2026

Date	Event
September 2, 2026	Date of breach on the California record
September 6, 2026	Baker Tilly learns of the incident
October 28, 2026	Review of the affected data completed; recipients identified
November 9, 2026	Letters dated; notice posted by the California attorney general
November 10, 2026	Massachusetts records the report (2,689 residents)

What happened in the Baker Tilly data breach?

The data sat on a platform that a service provider operates and that Baker Tilly uses to serve clients, not on Baker Tilly's own network. Baker Tilly says it moved to contain the incident, investigated with outside experts, and has notified and is working with law enforcement. It says it has found no evidence of continued unauthorized access to its network or systems. The letter does not name the platform or say how the intruder got in. BleepingComputer reported that Baker Tilly had not answered its questions about the source, the number affected or the data types by publication. Vendor breach notices compares other letters about data held by a provider.

Why did I get a breach letter from Baker Tilly?

Because your information was in client data Baker Tilly kept on the provider's platform. BleepingComputer reports that the data concerns clients and their dependents. If you never hired Baker Tilly yourself, the letter does not say why you are in the data, and the reported mention of dependents is one possible reason. The guide to CPA and advisory firm breach letters covers this case, with other firms' counts.

What information was exposed in the Baker Tilly breach?

The filed letter is a template, and the types of data are a placeholder filled in per person. The state records show what the placeholder holds for many recipients. Massachusetts marks Social Security numbers, and not medical, financial account, driver's license or card data. The Texas listing, as BleepingComputer read it, names Social Security numbers, full names and addresses.

What is Baker Tilly offering people who got the letter?

Two years of Experian IdentityWorks credit and identity monitoring at no cost. Baker Tilly says it is not aware of identity theft or fraud linked to the data. Questions go to 833-918-3966, Monday through Friday, 8 a.m. to 8 p.m. Central, quoting the engagement number printed on the letter. Credit monitoring offers in breach letters compares offers across the log.

How many people were affected by the Baker Tilly breach?

No national total has been published. The state counts so far are 10,456 in Texas (as reported by BleepingComputer from the Texas portal) and 2,689 in Massachusetts. The letter, BleepingComputer notes, gives no count. The guide to notice-letter delays puts the 64 days from discovery to letters against other notices.