Baker Tilly Data Breach

An unauthorized actor took data about Baker Tilly clients from a platform run by one of the firm’s outside vendors. Baker Tilly learned about it on September 6, 2026. Notice letters are dated November 9, more than nine weeks later.

What Happened at Baker Tilly’s Vendor

Baker Tilly Advisory Group, LP (“Baker Tilly”) is a large accounting, tax and advisory firm. Its notice letter lists a Chicago office address.

According to the Notice of Data Breach, Baker Tilly became aware of a potential cybersecurity incident on September 6, 2026. The incident involved information stored on a platform run by a third-party service provider. Baker Tilly used that provider for services it delivers to clients. The letter says an unauthorized actor was able to obtain data relating to certain Baker Tilly clients.

Baker Tilly says it contained the incident, hired outside experts to investigate and notified law enforcement. The company also says it has found no evidence of continued unauthorized access to its own network or systems.

Why It Took More Than Nine Weeks to Hear About It

The timeline in the notice letter breaks down like this:

• September 6, 2026: Baker Tilly becomes aware of the incident.
• October 28, 2026: Baker Tilly finishes reviewing the affected data and identifies whose information was involved, 52 days later.
• November 9, 2026: Notice letters are dated, 64 days after Baker Tilly learned of the incident.

During those weeks, the people whose information was taken had no way of knowing they should watch their accounts. Baker Tilly has not said when the unauthorized actor first got into the vendor’s platform.

The Vendor Problem

This breach did not start inside Baker Tilly’s own network, according to the letter. It happened on a platform run by an outside company. Baker Tilly has not named that vendor.

Accounting and advisory firms often share client files with outside platforms for things like document exchange, tax work and data processing. Each extra company that holds client data is another place that data can be stolen. Clients usually have no say in which vendors their accountants use.

What Information Was Exposed?

Baker Tilly has not publicly listed the types of information involved. In the sample notice letter, the line that names the affected data shows a placeholder instead of real data types. Each individual letter should list that person’s specific information.

Baker Tilly has also not disclosed how many people were affected. The company reported the incident to the California Attorney General. California requires that report when a single breach affects more than 500 California residents.

Because Baker Tilly handles tax and financial work, check your own letter carefully to see exactly which of your details were involved.

What Is Baker Tilly Offering?

Baker Tilly is offering 24 months of Experian IdentityWorks credit monitoring and identity restoration at no cost. The enrollment deadline and activation code are printed on each individual letter.

Questions about the incident or the Experian offer go to 833-918-3966, Monday through Friday, 8 a.m. to 8 p.m. Central Time. Callers should have the engagement number from their letter ready.

Your Information Is at Risk

Client files held by an accounting or advisory firm can contain the kind of detail identity thieves look for. Even when a company says it has seen no misuse yet, stolen data can surface months or years later.

Affected individuals can take these steps:

• Enroll in the Experian monitoring before the deadline on your letter
• Review bank, credit card and tax accounts for activity you do not recognize
• Order free credit reports at annualcreditreport.com
• Consider a free credit freeze with Equifax, Experian and TransUnion
• Keep your notice letter and any related emails

Do You Have Legal Options?

Firms that collect client information, and the vendors they trust with it, have a legal obligation to protect it. When that obligation is not met, affected individuals may have legal rights and remedies.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. 

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

Frequently Asked Questions

How many people were affected by the Baker Tilly data breach?

Baker Tilly has not disclosed a total. It reported the incident to the California Attorney General, which California requires when more than 500 California residents are affected.

What information was exposed?

Baker Tilly has not publicly listed the data types. The sample letter shows a placeholder where the data types belong. Your own letter should list the specific information involved for you.

Why did it take so long to get a letter?

Baker Tilly says it learned of the incident on September 6, 2026, and finished reviewing the affected data on October 28. Letters are dated November 9, 64 days after it learned of the incident.

Which vendor was breached?

Baker Tilly has not named the third-party service provider whose platform was involved.

What should I do now?

Take these steps:

• Enroll in the free Experian IdentityWorks monitoring using the code on your letter
• Watch your financial and tax accounts closely
• Consider a credit freeze
• Save your notice letter

Could scammers use this breach to target me?

Yes, that is a common follow-up risk. After a breach becomes public, scammers often send emails, texts or calls that mention the company by name to seem legitimate. Be careful with any message that:

• Asks you to confirm your Social Security number or bank details
• Pushes you to act fast or pay a fee
• Includes a link or attachment you did not expect

When in doubt, contact the company using the phone number printed on your official notice letter.

Do I have a legal claim?

You may. Companies that collect your personal information have a duty to protect it, and a duty to tell you promptly when it is exposed. If you received a Notice of Data Breach letter from Baker Tilly, contact Emery | Reddy at 916.995.5968 or visit www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.