The Baker Tilly Data Breach Leaked Social Security Numbers, And The Letters Just Landed

November 13, 2026 · 8 min read

A letter dated November 9 turns up in a woman’s mailbox. Her accounting firm is writing to say that her personal information was involved in an incident at a vendor she has never heard of. She reads it once, then files it. In February her tax return bounces, because somebody has already filed one using her Social Security number. Her refund sits frozen for months while she proves that she is herself. The Baker Tilly data breach is what made that February possible, and the letter in her hand was the warning.

Confirmation: confirmed by Baker Tilly Advisory Group, LP in a client notification letter dated November 9, 2026, and reported by BleepingComputer on November 11.

What happened in the Baker Tilly data breach

Baker Tilly says it became aware of a potential cybersecurity incident on September 6, 2026. A platform that a third-party service provider runs for the firm held the information. Baker Tilly uses that platform to serve clients. In the firm’s own words, the unauthorized actor was able to obtain data relating to certain Baker Tilly clients.

Then the slow part began. The firm completed its review of the affected data on October 28, 2026, which is when it worked out whose information was involved. Letters went out by mail on November 9, over the signature of the firm’s Chief Risk Officer and General Counsel. So roughly nine weeks passed between the discovery and the notice, and that gap is normal rather than negligent: a company cannot name the people in a stolen file until it has read the file.

Three things are still missing from the public record. Baker Tilly does not name the vendor. It does not give a national number either. And the firm says it has found no evidence of continued unauthorized access to its own network, which is a claim about Baker Tilly’s systems rather than about the vendor’s.

How many people, and how do you know if you are one

There is no national total. The one public count comes from a November 10 filing with the Texas Attorney General, which covers 10,456 people in Texas alone. Texas is one state out of fifty, so the real figure is larger by some unknown multiple.

The answer to “am I affected by the Baker Tilly data breach” is therefore simple and slightly unsatisfying: you are affected if you got the letter. Baker Tilly mailed notices to the clients it identified, and the notice covers clients and their dependents. Because these went by post rather than email, a household can easily mistake one for junk mail and throw it out. If a household member handles the mail, ask them.

What was exposed, and what a stranger can do with each piece

The Texas filing lists names, addresses, Social Security numbers and other information. The publicly filed sample letter does something more awkward: it leaves the list of data types as a blank merge field, which each recipient’s copy fills in. Your own letter is the one authority on your own fields. Read it, then keep it, because you will want the engagement number printed on it.

Here is what each piece buys an attacker:

Social Security number. This is the one that does not change. It opens new credit, and it files a tax return in your name before you do.
Name and address together. They make the next letter, call or email about “your account” sound legitimate.
“Other information.” Unspecified in public. Your letter names yours, and the response line can confirm it.

Baker Tilly says it is aware of no identity theft or fraud tied to the incident, and it says it believes the information will not be misused or sold. That is a genuine data point, not a guarantee, so treat it as the company’s current read rather than an outcome.

What to do now after the Baker Tilly data breach

Most of this has nothing to do with OptMsg, and it matters more than anything we sell. A leaked Social Security number is a credit problem and a tax problem first.

1. Freeze your credit at all three bureaus. Equifax, Experian and TransUnion each take a few minutes online. It is free, and it blocks new accounts instead of merely reporting them. 2. Get an IRS Identity Protection PIN. An accounting firm’s client list points straight at tax-return fraud, so this is the specific defense: request an IP PIN, then file early next year. 3. Enroll in the two years of Experian monitoring the letter offers. It costs nothing and it is already paid for. Monitoring reports fraud rather than stopping it, though, so the freeze comes first. 4. Call the response line if your letter is vague. Baker Tilly gives 833-918-3966, Monday to Friday, 8am to 8pm Central. Have your engagement number ready, then ask which fields were in yours.

If fraud does show up, IdentityTheft.gov is the free federal recovery plan, and it is the fastest route to the paperwork you will need.

The follow-up scam, and how to meet it

Every large notice like this one starts a second wave, because the people holding the file know you are expecting mail about it.

1. Expect the scam to wear a name you trust. It will arrive dressed as the firm, as the monitoring service, or as the IRS. So type the enrollment address from the paper letter yourself instead of following a link. Our guide to telling a real breach notice from a fake one walks through the tells. 2. Use a password manager, and turn on the strongest sign-in each account offers. A passkey beats an app code, and an app code beats a text message. 3. Watch the mail and the phone, not only the inbox. This file carries postal addresses, so the pitch may arrive on paper or as a call about your “case”.

Tired of strangers deciding what reaches you? Create your OptMsg account and see what an inbox looks like when you hold the guest list.

How OptMsg changes this exposure

OptMsg could not have prevented what happened here. The breach took place on another company’s platform, and no inbox reaches inside it. What an OptMsg account changes is narrower, and it is worth saying at its real size.

Two things. First, your OptMsg account has no password, so a password leaked from some other site cannot be tried against your inbox. Second, mail from a sender you have not approved goes to Trash rather than your Inbox, and Trash empties itself after 30 days. The activation notice that is really a phishing page comes from a sender you did not approve, so it waits in Trash where you can look at it calmly. That is the idea behind our Private page: your address is yours, and so is the guest list.

Now the limits, because they are real here. No public field list names email addresses in this incident, so the people holding this data may be writing to your mailbox or calling your phone, and no inbox rule touches either. The argument also does not cover a compromised device, a live phishing page you sign in to yourself, or someone with your unlocked phone. In short: for this breach, the credit freeze is the bigger move, and the inbox is the quieter one.

Create Your Account — Your Inbox. Your Rules.

Create Your Account

Frequently asked questions

How many people were affected by the Baker Tilly data breach?
No national figure has been published. A November 10 filing with the Texas Attorney General covers 10,456 Texas residents, and Texas is one state, so the total is larger by an unknown amount.

Was my Social Security number really in it?
Possibly. The Texas filing lists names, addresses and Social Security numbers, but the publicly filed sample letter leaves the data types as a blank field that is filled in for each recipient. Your own letter names your own fields, and the response line at 833-918-3966 can confirm them.

Which vendor was breached?
Baker Tilly has not named it. The notice describes a platform operated by a third-party service provider used in connection with client services, and that is all the public record says.

Is the free credit monitoring enough?
It helps, and it is worth enrolling because it is already paid for. Monitoring reports activity after it happens, though, so freeze your credit at all three bureaus as well.

How do I tell a real Baker Tilly letter from a scam?
A real notice came by post and carries an engagement number. It never asks for your Social Security number, a password or a payment. When in doubt, call 833-918-3966 from the letter rather than a number in an email.

Sources

BleepingComputer, November 11, 2026: https://www.bleepingcomputer.com/news/security/baker-tilly-notifies-clients-of-data-breach-at-third-party-provider/
Baker Tilly Advisory Group, LP, client notification letter dated November 9, 2026 (sample letter, publicly filed)
Texas Attorney General data breach report, filed November 10, 2026: https://www.texasattorneygeneral.gov/consumer-protection/identity-theft/data-breach-notifications
IRS, Identity Protection PIN: https://www.irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin