Summary
- Environment: Third-party client-services platform
- Operational impact: Client information obtained; service disruption not quantified
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed November 12, 2026; updated as evidence emerges.
What happened
Baker Tilly Advisory Group learned on September 6, 2026 that a platform operated by a service provider had been compromised. An unauthorized actor obtained data relating to some clients. [1]
Impact
The company completed its affected-data review October 28. Its public notification template does not specify the personal-information fields or number of affected people. [1]
Timeline
Incident detected
Baker Tilly became aware of the third-party incident.
[1]Data review completed
The review identified whose information was involved.
[1]Client letter issued
The notification sample described the investigation and response.
[1]Briefing updated
This briefing was last reviewed and updated on November 12, 2026.
Threat Group & Attack Vector
The platform provider and initial access method have not been identified in the reviewed notice. September 6 is the detection date, not an established attack-start date.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific ATT&CK technique is mapped from the available evidence.
Response
Baker Tilly took containment steps, engaged outside experts and worked with law enforcement. It reported no evidence of continued unauthorized access after discovery or known related identity theft, and offered two years of credit and identity monitoring. [1]