The company said the exposed data was stored on a platform operated by a third-party service provider Baker Tilly uses to serve clients. Baker Tilly learned of the incident on September 6 and completed its review of the affected data on October 28, when it identified whose information was involved.
"On September 6, 2026, Baker Tilly became aware of a potential cybersecurity incident involving certain information stored on a platform operated by a third-party service provider used by Baker Tilly in connection with services we provide to clients," reads the notification to customers. "The unauthorized actor was able to obtain data relating to certain Baker Tilly clients," the company added. The breach notification does not provide a count of impacted clients, does not name the service provider, and leaves the specific data types exposed as a placeholder.
