Baker Tilly Advisory Group, one of the largest accounting and advisory firms in the U.S., is sending letters to clients saying an unauthorized actor obtained some of their personal information from a platform run by one of its outside service providers. The firm says the data was stored on that outside provider's platform. That is why this one matters to small businesses: your accountant, your law firm and your financial advisor all keep your files in software and portals run by somebody else.
What Baker Tilly and state regulators have said
In a sample notification letter dated November 9, 2026, and signed by its chief risk officer and general counsel, Baker Tilly writes: "On September 6, 2026, Baker Tilly became aware of a potential cybersecurity incident involving certain information stored on a platform operated by a third-party service provider used by Baker Tilly in connection with services we provide to clients. The unauthorized actor was able to obtain data relating to certain Baker Tilly clients."
The firm says it brought in outside experts, notified law enforcement, and finished reviewing the affected data on October 28, 2026, when it worked out whose information was involved. It says that "since identifying the incident, we have found no evidence of continued unauthorized access to our network or systems," and that it is "not aware of identity theft or fraud related to information affected by this incident." Affected people are offered two years of Experian credit and identity monitoring.
The California Attorney General's breach list shows Baker Tilly Advisory Group, LP reporting on November 9, 2026, with a breach date of September 2, 2026. BleepingComputer reported on November 11 that the Texas Attorney General's portal lists 10,456 affected Texans and names Social Security numbers, full names and addresses among the data types. BleepingComputer also noted that the letter does not name the service provider, does not give a total count, and leaves the specific data types as a placeholder in the posted sample. It said it found no ransomware group claiming the attack.
What we are not claiming: We don't know which service provider or platform was involved, and Baker Tilly hasn't said. We don't know how many people were affected nationally; the 10,456 figure is Texas residents only, as reported from the Texas Attorney General's portal. We are not saying this was ransomware, that tax returns were filed fraudulently, or that any data has been misused; Baker Tilly says it is not aware of identity theft or fraud. Exactly what was taken for any one person depends on their letter.
Why this matters to small businesses and professional firms
Most small businesses think of "our data" as what sits on their own computers and Microsoft 365 account. In practice, a lot of your most sensitive information lives with your professional advisors: payroll records, tax returns with employee and family Social Security numbers, bank statements, loan files. Those firms, in turn, store it in client portals, file-sharing services, tax and audit software and e-signature tools. When one of those platforms is breached, it doesn't matter how good your own firewall is.
If you run an accounting, legal, engineering or financial firm yourself, read it from the other side. Your clients will ask you the same questions Baker Tilly's clients are asking now. The gap between discovery (September 6) and letters (November 9) is typical: it takes weeks to figure out which files were on the platform and whose data was in them. Firms that already know which vendor holds which client data get through that review faster.
What to do this week
- If you get a letter, act on it. Enroll in the monitoring offered, and consider a free credit freeze with all three bureaus. Call the number printed in your letter, not one in a follow-up email or text.
- Get an IRS Identity Protection PIN. Anyone with a Social Security number can request one at irs.gov. It makes a fraudulent return in your name much harder, and it is free.
- Ask your accountant, attorney and advisor where your files live. Which portal, file-sharing or tax platform holds your documents? Is multi-factor authentication required for staff and for you? How long do they keep old files, and can they delete what they no longer need?
- Stop emailing sensitive documents. Use the firm's secure portal with MFA on your own login, and remove old shared folders and links you no longer use.
- Warn staff about follow-on phishing. Breach news is a favorite hook for fake "update your information" emails. Nobody should send a Social Security number, bank detail or password in response to an unexpected message, even one that looks like it came from your accountant.
- For firms: inventory your vendors. List every outside platform that stores client data, what data it holds, who can log in, and what your contract says about breach notice. Close accounts and purge data from tools you've stopped using.
The takeaway for IT decision-makers
Your exposure doesn't stop at your own network. It includes every advisor you send files to and every platform they use. You can't audit Baker Tilly or any large firm yourself, but you can ask where your files sit, insist on MFA and secure portals instead of email, and keep your own vendor list current so that when a letter like this arrives, you already know what to check.
Sources
- Baker Tilly Advisory Group: sample client notification letter (dated Nov 9, 2026; posted copy checked Nov 13, 2026)
- California Attorney General: Submitted Breach Notification Sample, Baker Tilly Advisory Group, LP (breach date 9/2/2026; checked Nov 13, 2026)
- California Attorney General: Data Security Breach list (Baker Tilly Advisory Group, LP, reported 11/09/2026; checked Nov 13, 2026)
- BleepingComputer: Baker Tilly notifies clients of data breach at third-party provider (Nov 11, 2026; Texas Attorney General figure of 10,456 Texans)
- IRS: Get an Identity Protection PIN