Breach victims discover their data was held by companies they’ve never heard of
Nearly seven in ten people affected by data breaches handled by Kroll were exposed through an outside supplier, according to its Data Breach Outlook 2026.
Businesses rely on outside providers to store information, process transactions and operate software. A breach at one of those providers can expose customer records across multiple organizations, including people who have never heard of the company holding their data.
Percentage of individuals impacted due to a third party, by industry (Source: Kroll)
“Across most of the major incidents we handled over the past year, a vendor, software supplier or service provider was the link between the initial breach and the organizations affected. One incident can reach businesses and individuals who have never dealt directly with the company where the compromise began,” said Denyl Green, Global Head of Breach Notification at Kroll.
Technology providers extend the reach of breaches
Technology companies accounted for 6% of breach cases and 60% of affected individuals.
Providers serving multiple clients can hold records belonging to customers across several industries. A compromise at one company can require many organizations to investigate their exposure.
For example, several retailers might use the same provider to manage customer records. A theft from that provider could expose information belonging to each retailer. Subcontractors can extend the chain when a supplier uses another company to store or process its clients’ data.
The MOVEit file-transfer attacks illustrate this. Organizations were exposed through their own use of the software and through vendors that used it to handle their information.
Supplier relationships complicate investigations
After a supplier breach, each client needs to establish if its records were involved, which details were exposed and who needs to be notified. Those decisions may depend on evidence from the compromised provider.
Responsibility for contacting affected individuals can require coordination. Information may belong to one organization, sit with another and be compromised at a subcontractor.
Around four in ten respondents cited vendor dependencies as a challenge when making breach-response decisions.
For customers, notifications need to explain how an unfamiliar supplier obtained their information, what was exposed and what action they should take.
One incident can generate hundreds of insurance claims
Shared providers also create exposure for cyber insurers, bringing claims from businesses affected by the same incident.
“A single supplier breach can trigger dozens or even hundreds of cyber insurance claims from businesses whose only connection is that they use the same provider. These scenarios exponentially increase potential cyber insurance losses compared to breaches affecting a single business,” said Katherine Keefe, Global Cyber Insurance Industry Lead at Kroll.
She said underwriters are examining how businesses manage suppliers and identifying providers whose services could create a single point of failure across many organizations. When several policyholders are affected, claims teams also need to coordinate incident response and breach notifications.
“Cyber insurers now know that identifying dependencies on common vendors is critical to assessing and minimizing the risk that one breach will impact many policyholders.”
