Baker Tilly confirms client data theft from a third-party platform
Baker Tilly says an unauthorized party obtained client data stored on a service provider’s platform. Texas lists 10,456 affected residents and Social Security numbers among the data types. Massachusetts lists 2,689 residents and South Carolina lists 1,359.
- Disclosed
- Nov 9, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Notified Baker Tilly clients and affected individuals, including some children addressed through parents or guardians.
- Baker Tilly · third-party provider · data breach
- In the wild
- Yes
- Baker Tilly confirms an unauthorized party obtained client data.
What happened
The company’s letter confirms an outside party obtained data from the provider’s platform. It does not name the provider or identify how access began. The California register gives September 2 as a breach date. Baker Tilly says it learned of the incident September 6 and identified whose information was affected on October 28. The Texas public row lists names, addresses, Social Security numbers and an unspecified other category. The public sample uses placeholders for individual fields. The state counts above apply only to their respective jurisdictions. The reviewed public records do not establish a verified overall count. Baker Tilly says it notified law enforcement and had no known related identity theft or fraud when it issued the notice.
Crime-scene timeline
Sep 6, 2026
Baker Tilly learns of the incident
The company investigates and takes containment measures.
Oct 28, 2026
Review identifies affected individuals
Baker Tilly says it completes its data review and works to verify contact information.
Nov 9, 2026
California and South Carolina list notices
Baker Tilly’s sample is dated November 9. South Carolina lists 1,359 residents.
Nov 10, 2026
Texas and Massachusetts publish state-specific scope
Texas lists 10,456 residents and Massachusetts lists 2,689. Both list Social Security numbers among the affected data.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Baker Tilly notice filed in CaliforniaPrimaryConfirms data acquisition, review timing, adult and minor notice variants and two years of monitoring.
- Texas Attorney General public registerPrimaryLists the 10,456 Texas residents and data categories in its public table.
- Massachusetts 2026 breach notification reportPrimaryEntry 2026-1977 lists 2,689 Massachusetts residents and Social Security number exposure.
- South Carolina Consumer Affairs registerPrimaryLists 1,359 South Carolina residents and a November 9 filing.