The Vendor Was Breached. Your SSN Was Inside.

One of the largest accounting firms in the United States is telling its clients their Social Security numbers may be in criminal hands — and the breach did not happen on its own network. Baker Tilly Advisory Group confirmed this week that an unauthorized actor obtained client data stored on a platform run by a third-party service provider. The firm learned of the incident on September 6 and finished reviewing the affected data on October 28. The total number of people affected has not been disclosed — but the Texas Attorney General’s office alone lists 10,456 affected residents, with Social Security numbers, full names, and addresses among the exposed data.

Baker Tilly is a major U.S. accounting firm — auditing, tax planning, compliance, advisory — with a global network in 147 countries and $6.8 billion in annual revenue. Its clients trusted it with exactly the information criminals prize most: tax records, identities, financial details.

What was exposed

The breach notice itself leaves the specific data types as a placeholder — it does not list what was taken. The Texas filing fills in part of the picture: Social Security numbers, full names, addresses, and “other information.” South Carolina’s breach register lists 1,359 affected residents there. No total count has been published, and with filings appearing state by state, the real number is almost certainly far higher than the Texas figure alone.

A password can be changed; a Social Security number follows you for life. Paired with a real name and address, it is enough to open accounts, file a fraudulent tax return, or build a convincing identity-theft scheme. That is why the exposure matters more than the headcount suggests.

What Baker Tilly is — and isn’t — saying

The firm’s notice is careful about what it confirms. “On September 6, 2026, Baker Tilly became aware of a potential cybersecurity incident involving certain information stored on a platform operated by a third-party service provider used by Baker Tilly in connection with services we provide to clients,” it reads. “The unauthorized actor was able to obtain data relating to certain Baker Tilly clients.”

The company says it contained the incident, brought in outside experts, and notified law enforcement. It has no evidence of unauthorized activity on its own network, and no reports of identity theft or fraud linked to the exposure. Affected individuals get 24 months of credit and identity monitoring through Experian.

What the notice does not say is just as important. It does not name the provider, explain how the attacker got in, or give a total victim count. And BleepingComputer found no ransomware group claiming the attack — so there is no public claim to check against, and no way for clients to judge how the data was taken or where it might surface next.

The pattern keeps repeating

This is the third time in a month this blog has covered a breach that came through a third-party provider rather than the victim’s own network. In the TSMC case, a leak at a cloud provider exposed roughly 46,000 employees — and TSMC, like Baker Tilly, could say its own systems were not compromised. In the Iris Ohyama case, a suspicious file in a third-party cloud service exposed up to 7.7 million shoppers.

The pattern is the point. Companies audit their own networks and then hand their most sensitive data to providers whose security they never see. The provider stays unnamed, the intrusion vector stays unpublished, and the company whose name is on the breach notice takes the reputational hit while the system that actually failed stays in the shadows. Clients cannot judge a risk they cannot see — and they cannot protect themselves from a vendor they never chose.

Clients are learning now about an incident that began in early September: two months passed between discovery on September 6 and the completion of the review on October 28.

What to do if you got the letter

If you received a breach notice from Baker Tilly, take the monitoring offer — 24 months of Experian credit and identity monitoring costs you nothing and gives you an early warning if your data is used. But monitoring only tells you after the fact. A credit freeze with the three major bureaus is stronger: it stops new accounts from being opened in your name at all, and it costs nothing to place or lift.

Watch for tax fraud in particular: a Social Security number plus a real name and address is exactly what a criminal needs to file a fake return and steal the refund — and tax season is coming. Consider filing early. And be skeptical of any message that uses your real details to sound legitimate: a phishing email that knows you are a Baker Tilly client is far more convincing than a generic scam.

Baker Tilly’s own network held. Its clients’ data did not — because it was not in Baker Tilly’s network. That is the lesson of this breach, and of the two before it: the perimeter you defend is no longer the perimeter that matters, and the vendor you never met may be the one holding your Social Security number.

Source: BleepingComputer, November 11, 2026 — Baker Tilly notifies clients of data breach at third-party provider.