6 September 2026: Baker Tilly Advisory Group, LP learned of a potential incident on a third-party service platform used for client work. Texas AG nationwide total, posted 10 November: 195,512 people. See the Baker Tilly breach record.
Massachusetts sample 2026-1977, signed Theresa Meiners, letters 9 November. California sample 9 November. File review finished 28 October. Vendor unnamed. 24 months Experian IdentityWorks. Call 833-918-3966. The firm says its own network did not show continued unauthorised access.
What happened at Baker Tilly?
A third-party platform used for client work was reached. An unauthorised actor obtained data relating to certain Baker Tilly clients. Do not invent the vendor name. Law enforcement notified. This is not a statement that every Baker Tilly office laptop was copied.
The first catalog row had recordsAffected 0 because Massachusetts did not publish a nationwide total. Texas did: 195,512 people, 10,456 Texans. Massachusetts 2,689 residents. Update the census. Keep the unnamed-vendor rule.
What data was exposed?
Texas AG extract: name, postal address, Social Security number. The Massachusetts sample used a mail-merge token for fields. Mix may still vary by person. recordsAffected is 195512.
An SSN plus a client's accounting-firm relationship is tax-fraud material. Freeze credit. Watch IRS and state tax mail.
The Atlantic FCU post is another November vendor-platform notice.
Who is affected?
Certain Baker Tilly clients, 195,512 people in the Texas nationwide total. Not every Baker Tilly client is automatically in the file. People whose work never sat on that unnamed platform are outside this row.
More on the firm is on the Baker Tilly Advisory Group company page.
What should clients do?
- Enrol in Experian IdentityWorks with the code in the 9 November letter.
- Call 833-918-3966.
- Place a freeze if an SSN may be involved.
- Ask your engagement partner, in writing, whether your matter sat on the reached platform.
- Baker Tilly will not collect a card CVV to restore a client portal.
A later vendor name, if the firm publishes one, does not change the 195,512 census unless a new filing says so.
Why was the count zero before?
Massachusetts published a sample without a nationwide total. Texas later filed 195,512. Catalogues that wait for a named census were correct to sit at 0 until that filing.
Do not treat 2,689 Massachusetts residents as the full file. That is a state slice of 195,512.
Frequently asked questions
How many people were affected?
195,512, the Texas AG nationwide total posted 10 November 2026, including 10,456 Texans. Massachusetts sample listed 2,689 residents.
Which vendor?
Unnamed. Do not invent it.
When did Baker Tilly learn of this?
6 September 2026. Review finished 28 October. Letters 9 November.
Were Social Security numbers involved?
Yes, on the Texas extract, with name and address.
Was Baker Tilly's own network copied?
The firm says it has no evidence of continued unauthorised access to its own network. The reached system is a third-party platform.
Sourcing note: Massachusetts AG 2026-1977, California AG 9 November, Texas AG 10 November nationwide 195,512.
Do not download alleged Baker Tilly dumps. This catalog does not link them. A later leak-site post is still an unverified brand until Baker Tilly names it.
Compare later mail with bakertilly.com. Baker Tilly will not ask for a card CVV or a one-time code through a new website to finish this investigation.
Do not merge this row with Baker McKenzie. They are separate catalog files even when they share a season or a vendor class.
If you did not receive a letter, you may still be in an unpublished state filing. Ask Baker Tilly in writing whether your identifier sits in the reached file.
US residents can place a free credit freeze at Equifax, Experian and TransUnion. Use the local freeze or watch process named in the notice if you live elsewhere.
Keep the paper letter if one arrives. A later amendment can add fields or a higher census. This catalog will move recordsAffected only when a named official source publishes a new figure. Do not treat a class-action advertisement as a census.
If two organisations share a similar name, read the company page before you enrol in monitoring. Wrong-firm sign-up pages are a common follow-on scam after a widely reported notice.
People who already froze credit last year should still read the new letter, because the field mix may differ this time. A freeze stays in place until you lift it.