{
  "id": "baker-tilly-provider-data",
  "url": "https://ohshit.app/incidents/baker-tilly-provider-data/",
  "title": "Baker Tilly confirms client data theft from a third-party platform",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-09",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Baker Tilly",
    "third-party provider",
    "data breach"
  ],
  "ecosystems": [],
  "summary": "Baker Tilly says an unauthorized party obtained client data stored on a service provider’s platform. Texas lists 10,456 affected residents and Social Security numbers among the data types. Massachusetts lists 2,689 residents and South Carolina lists 1,359.",
  "splash": "Notified Baker Tilly clients and affected individuals, including some children addressed through parents or guardians.",
  "wipe": "Verify the mailed notice, review your credit, and follow the notice to use the two-year monitoring offer.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify your notice and affected fields",
      "hint": "Compare the mailed letter with the regulator’s published sample. Use the verified number 833-918-3966 or an established Baker Tilly contact, and keep the engagement number private. Parents or guardians can confirm the fields listed in a child’s notice."
    },
    {
      "title": "Use the monitoring offer and protect credit",
      "hint": "The letter offers two years of Experian monitoring, including a separate option for minors. Follow the enrollment instructions and deadline on your verified notice. Review credit reports and statements. Consider a freeze with the three national credit bureaus if a Social Security number was affected."
    },
    {
      "title": "Report suspicious activity",
      "hint": "Contact the financial institution involved if you find unfamiliar accounts or charges. Use IdentityTheft.gov for a recovery plan if you find misuse. Keep the original notice and any related records."
    }
  ],
  "sources": [
    {
      "name": "Baker Tilly notice filed in California",
      "url": "https://oag.ca.gov/system/files/Baker%20Tilly%20-%20Sample%20Individual%20Notice.pdf",
      "says": "Confirms data acquisition, review timing, adult and minor notice variants and two years of monitoring.",
      "primary": true
    },
    {
      "name": "Texas Attorney General public register",
      "url": "https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage",
      "says": "Lists the 10,456 Texas residents and data categories in its public table.",
      "primary": true
    },
    {
      "name": "Massachusetts 2026 breach notification report",
      "url": "https://www.mass.gov/doc/data-breach-report-2026/download",
      "says": "Entry 2026-1977 lists 2,689 Massachusetts residents and Social Security number exposure.",
      "primary": true
    },
    {
      "name": "South Carolina Consumer Affairs register",
      "url": "https://consumer.sc.gov/index.php/identity-theft-unit/security-breach-notices",
      "says": "Lists 1,359 South Carolina residents and a November 9 filing.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Baker Tilly confirms an unauthorized party obtained client data.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Sep 6, 2026",
      "title": "Baker Tilly learns of the incident",
      "body": "The company investigates and takes containment measures."
    },
    {
      "date": "Oct 28, 2026",
      "title": "Review identifies affected individuals",
      "body": "Baker Tilly says it completes its data review and works to verify contact information."
    },
    {
      "date": "Nov 9, 2026",
      "title": "California and South Carolina list notices",
      "body": "Baker Tilly’s sample is dated November 9. South Carolina lists 1,359 residents."
    },
    {
      "date": "Nov 10, 2026",
      "title": "Texas and Massachusetts publish state-specific scope",
      "body": "Texas lists 10,456 residents and Massachusetts lists 2,689. Both list Social Security numbers among the affected data."
    }
  ],
  "body_markdown": "The company’s letter confirms an outside party obtained data from the provider’s platform. It does not name the provider or identify how access began. The [California register](https://oag.ca.gov/ecrime/databreach/reports/sb24-632686) gives September 2 as a breach date. Baker Tilly says it learned of the incident September 6 and identified whose information was affected on October 28. The Texas public row lists names, addresses, Social Security numbers and an unspecified other category. The public sample uses placeholders for individual fields. The state counts above apply only to their respective jurisdictions. The reviewed public records do not establish a verified overall count. Baker Tilly says it notified law enforcement and had no known related identity theft or fraud when it issued the notice."
}