---
id: "CMP-202611-ybugvc"
page: "https://infrastack.ai/live/CMP-202611-ybugvc"
kind: "campaign"
aliases: []
title: "Baker Tilly breached through a third-party provider: client names, addresses and Social Security numbers stolen; expect scams posing as Baker Tilly"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Baker Tilly", "fixed": [], "vendor": "Baker Tilly Advisory Group", "affected": "client data on a third-party provider platform"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-11T23:25:47+00:00"
updated_at: "2026-11-11T23:26:17+00:00"
sources: [{"source": "analyst", "url": "https://www.bleepingcomputer.com/news/security/baker-tilly-notifies-clients-of-data-breach-at-third-party-provider/", "first_seen_at": "2026-11-11T23:25:47+00:00", "cites": ["https://www.bleepingcomputer.com/news/security/baker-tilly-notifies-clients-of-data-breach-at-third-party-provider/"]}]
exploit_sources: []
---

# Baker Tilly breached through a third-party provider: client names, addresses and Social Security numbers stolen; expect scams posing as Baker Tilly

Link for people: https://infrastack.ai/live/CMP-202611-ybugvc (this .md is for agents)

Baker Tilly Advisory Group (US accounting and advisory firm) is notifying clients that someone took data about them and their dependents from a platform run by an unnamed third-party service provider that Baker Tilly uses for client work. Breach date: 2 Sep 2026 (California AG filing). Baker Tilly found out on 6 Sep, finished its review on 28 Oct, and dated the notice letters 9 Nov 2026. Data exposed: names, addresses, Social Security numbers and other information (varies by person). Confirmed counts: 10,456 people in Texas and 111 in Rhode Island. Law-firm summaries of regulator data give a total of 195,512 (not confirmed by Baker Tilly). Baker Tilly says it has no evidence that anyone got into its own network. The provider's name and the attack method are unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Baker Tilly affected client data on a third-party provider platform fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record says the data was taken from a platform run by an unnamed third-party provider, while Baker Tilly reports no evidence of intrusion into its own network and the provider's name and attack method are unknown.

How it reached others: customers' data or keys went with it (third-party-breach).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#third-party-breach

## How to check

Did you, or your business, get a Baker Tilly notice letter dated 9 Nov 2026, or are you a Baker Tilly client? Be wary of emails, calls or letters that claim to be from Baker Tilly or that quote your SSN or address and ask you to pay, verify your identity or click a link. The real notice came by US mail. No lure domains or subject lines have been reported yet (unknown).

## Fix

If you are affected: freeze your credit with Equifax, Experian and TransUnion, enroll in any monitoring Baker Tilly offers, and file an IRS Identity Protection PIN request. Check any message about Baker Tilly by calling the firm on a number you already know, not one given in the message.

## Timeline

- 2026-11-11T23:25:47+00:00 analyst https://www.bleepingcomputer.com/news/security/baker-tilly-notifies-clients-of-data-breach-at-third-party-provider/

## Documents

- [describes] @BleepinComputer: Baker Tilly notifies clients of data breach at third-party provider
https://t.co https://x.com/BleepinComputer/status/2120653250508526024
- [describes] Baker Tilly notifies clients of data breach at third-party provider https://www.bleepingcomputer.com/news/security/baker-tilly-notifies-clients-of-data-breach-at-third-party-provider/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_