---
title: "Baker Tilly third-party client-data theft"
description: "Baker Tilly confirmed client-data theft from an unnamed service provider’s platform after detecting an incident in September 2026."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-12"
canonical_url: "https://www.ally.security/incidents/baker-tilly-third-party-client-data-theft-2026"
markdown_url: "https://www.ally.security/incidents/baker-tilly-third-party-client-data-theft-2026.md"
stix_url: "https://www.ally.security/incidents/baker-tilly-third-party-client-data-theft-2026/stix.json"
---

# Baker Tilly third-party client-data theft

Baker Tilly confirmed client-data theft from an unnamed service provider’s platform after detecting an incident in September 2026.

Last modified Nov 12, 2026 · 1 source

## Summary

- **Environment:** Third-party client-services platform
- **Operational impact:** Client information obtained; service disruption not quantified
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Baker Tilly Advisory Group](https://www.bakertilly.com/) learned on September 6, 2026 that a platform operated by a service provider had been compromised. An unauthorized actor obtained data relating to some clients. [1](#source-1)

## Impact

The company completed its affected-data review October 28. Its public notification template does not specify the personal-information fields or number of affected people. [1](#source-1)

## Timeline

### September 6, 2026 — Incident detected

Baker Tilly became aware of the third-party incident. [1](#source-1)

### October 28, 2026 — Data review completed

The review identified whose information was involved. [1](#source-1)

### November 9, 2026 — Client letter issued

The [notification sample](https://oag.ca.gov/system/files/Baker%20Tilly%20-%20Sample%20Individual%20Notice.pdf) described the investigation and response. [1](#source-1)

### November 12, 2026 — Briefing updated

This briefing was last reviewed and updated on November 12, 2026.

## Threat Group & Attack Vector

The platform provider and initial access method have not been identified in the reviewed notice. September 6 is the detection date, not an established attack-start date.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific ATT\&CK technique is mapped from the available evidence.

## Response

Baker Tilly took containment steps, engaged outside experts and worked with law enforcement. It reported no evidence of continued unauthorized access after discovery or known related identity theft, and offered two years of credit and identity monitoring. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/baker-tilly-third-party-client-data-theft-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Baker Tilly client notification sample

official · Baker Tilly Advisory Group, LP · Nov 9, 2026

<https://oag.ca.gov/system/files/Baker%20Tilly%20-%20Sample%20Individual%20Notice.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   Client notification letter issued: 2026-11-09
2. **Disclosed At · 100% confidence · current**  
   Baker Tilly third-party client-data theft: 2026-11-09
3. **Resulted In · 100% confidence · current**  
   Baker Tilly third-party client-data theft: The affected-data review finished October 28. The public sample leaves the specific personal-information categories as an unfilled template field and gives no affected-person total.
4. **Resulted In · 100% confidence · current**  
   Baker Tilly third-party client-data theft: Baker Tilly learned September 6 of an incident on an unnamed third-party service provider platform used for client services. An unauthorized actor obtained data relating to certain clients.
5. **Resulted In · 100% confidence · current**  
   Baker Tilly third-party client-data theft: Client notification letter issued
6. **Discovered At · 100% confidence · current**  
   Baker Tilly third-party client-data theft: 2026-09-06
7. **Resulted In · 100% confidence · current**  
   Baker Tilly third-party client-data theft: Third-party incident detected
8. **Occurred At · 100% confidence · current**  
   Third-party incident detected: 2026-09-06
9. **Affected Organization · 100% confidence · current**  
   Baker Tilly third-party client-data theft: Baker Tilly Advisory Group, LP
10. **Resulted In · 100% confidence · current**  
   Baker Tilly third-party client-data theft: Baker Tilly took containment steps, used outside experts and notified law enforcement. It reported no evidence of continued unauthorized access after discovery and no known related identity theft or fraud, and offered two years of monitoring.
11. **Resulted In · 100% confidence · current**  
   Baker Tilly third-party client-data theft: Affected-data review completed
12. **Occurred At · 100% confidence · current**  
   Affected-data review completed: 2026-10-28

</details>