BleepingComputer reported on 11 November 2026 that accounting firm Baker Tilly is warning clients about a data breach. Baker Tilly said an unauthorized actor took data on some clients from a platform run by an outside provider. The firm learned of it on 6 September and finished checking whose data was involved on 28 October.
BleepingComputer noted that the notice has no client total, no provider name, and a blank where data types belong. The Texas Attorney General's office lists 10,456 affected people in Texas alone, with Social Security numbers, names and addresses among the data. Baker Tilly says it has no evidence of unauthorized activity on its own network, yet it is the one notifying clients. It also says no fraud or identity theft has been reported to it. The report does not say how the attacker got in.
Where a vendor runs the platform, the vendor holds the logs, controls access and is the first to see trouble. The client learns only what the vendor passes on. So a firm's data is only as safe as its vendors' systems. Buyers should ask vendors three things: how fast they must report a breach, who keeps the logs, and what they must disclose.