Baker Tilly Advisory Group, LP discovered an unauthorized cybersecurity incident on September 6, 2026, involving a third-party service provider platform used for client services. An unauthorized actor accessed client-related data on September 2, 2026. The firm completed its internal review of the impacted files on October 28, 2026, and submitted regulatory filings to multiple state attorneys general, including California and Texas.
The compromised personal information included names, postal addresses, and Social Security numbers. State filings confirm that at least 10,456 residents in Texas and 111 residents in Rhode Island were impacted. Notices were also submitted to authorities in California and Massachusetts, though a total nationwide count has not been publicly released.
Baker Tilly began issuing notification letters by mail to affected individuals on November 9, 2026, offering complimentary credit monitoring services. Incident investigations and disclosures remain ongoing as additional regulatory filings may occur.