Ask a leadership team where its customer data lives and the answer usually comes quickly: our servers, our Microsoft 365 tenant, the CRM, the payroll provider. The full answer also includes every company those vendors rely on, and few organizations have ever written that list down.
That gap now has a number attached. In its Data Breach Outlook 2026, announced October 22, 2026, Kroll reported that 69% of individuals affected by the incidents it handled between June 2025 and June 2026 were impacted by a third-party breach. Of those individuals, 79% were affected by a breach in the technology sector. As Kroll’s Denyl Green put it, “One incident can reach businesses and individuals who have never dealt directly with the company where the compromise began.”
Key takeaways
- In the breaches Kroll handled over the past year, most affected people were exposed through a third party, and technology suppliers accounted for most of that exposure.
- Under Missouri law, a vendor holding your data must tell you about a breach, but the duty to notify affected Missouri residents stays with you as the owner or licensee of that data.
- You cannot audit every supplier, but you can know where your sensitive data goes, what your contracts require, and who acts first when a vendor calls with bad news.
What the numbers show
Kroll’s report combines two sources: breach cases handled by its Cyber and Data Resilience practice from June 2025 to June 2026, and a survey of 250 risk and compliance leaders, C-suite executives, and board members. Among those surveyed, 69% said their organization had suffered a breach in the previous 12 months.
The sector rankings tell the more useful story. According to Kroll, technology ranked 7th by number of organizations breached but 1st by number of individuals affected. Insurance ranked 9th for organizations and 2nd for individuals. HIPAA Journal’s coverage of the report on October 26, 2026 reported the same pattern.
The logic is easy to follow. A software or service provider holds records for many customers at once, so one compromise at that provider becomes many notifications downstream.
Kroll’s findings are not an outlier. Verizon’s 2025 Data Breach Investigations Report, released April 23, 2025, analyzed 12,195 confirmed data breaches and found that third-party involvement had doubled to 30%. The two studies measure different things (Kroll counts affected individuals in its own cases, Verizon counts breaches), but both point in the same direction.
The pattern has a well-known example. On June 7, 2023, CISA and the FBI warned that the CL0P ransomware gang had been exploiting CVE-2023-34362 in Progress Software’s MOVEit Transfer, a managed file transfer product, since May 27, 2023. File transfer tools exist to move data between organizations, and Help Net Security’s summary of the Kroll report cites MOVEit as a case of a breach spreading through shared software and vendors.
Why it matters: the people signing contracts worry least
The following is our analysis of Kroll’s survey data.
Kroll found that 54% of IT and technology leaders named vendor and third-party breaches as their biggest compliance risk. Only 40% of C-suite executives and 30% of risk and compliance leaders said the same. Separately, 41% of respondents cited dependence on vendors as a top-four challenge in breach-response decisions.
That gap matters because vendor relationships are usually chosen and negotiated by finance, operations, or department heads, not by IT. The people closest to the systems see the exposure most clearly, while the people who sign the agreements may be weighing price, features, and convenience instead.
When a supplier is breached, the costs land on the customer organization anyway: customer calls, legal review, notification letters, insurance conversations, and reputational damage. Few customers will care that the compromise started somewhere else.
The Missouri angle: their breach, your notice
Missouri’s breach notification law, RSMo 407.1500, splits responsibility in a way every Missouri organization should understand:
- A person that maintains or possesses records containing Missouri residents’ personal information, but does not own or license it, must notify the owner or licensee “immediately following discovery” of a breach, consistent with the legitimate needs of law enforcement.
- The owner or licensee must notify affected consumers “without unreasonable delay.”
- If notice goes to more than 1,000 consumers at one time, the attorney general’s office and all nationwide consumer reporting agencies must also be told about the timing, distribution, and content of the notice.
- Notice is not required if, after an appropriate investigation or consultation with relevant federal, state, or local law enforcement agencies, the organization determines that identity theft or other fraud is not reasonably likely. That determination must be documented in writing and kept for five years.
In practice, your vendor’s breach becomes your notification decision, and you can only make it well if the vendor gives you fast, specific information. Organizations in regulated sectors such as healthcare and financial services may have additional federal obligations. This is general information, not legal advice, so review your obligations with counsel.
Map the data, not just the vendor list
Most organizations keep a vendor list for accounts payable. Few keep a list of where sensitive data actually goes. The second list is the one that matters during a breach.
Start by tiering vendors by the data they hold, not by what you spend with them. For example, an inexpensive file sharing tool holding employee tax forms belongs above a large marketing contract that never touches personal information.
Missouri’s statute gives a practical definition to work from: a resident’s name combined with an unencrypted or unredacted Social Security number, government ID number, financial account or card number with its access code, medical information, or health insurance information. Any vendor holding those combinations is top tier.
You do not need to audit every supplier. A reasonable middle path is to go deep on the top tier, set basic contract terms for the middle tier, and simply stop sharing data with vendors that do not need it.
What to do next
This month
- Build a top-tier list. Identify every vendor that stores or processes the personal information categories above. Payroll, benefits, accounting, HR platforms, CRMs, file transfer and sharing services, and IT management tools are common candidates.
- Ask five questions of each top-tier vendor. Which subcontractors and hosting providers touch our data? How quickly will you notify us of a breach, and through whom? What will that notice include (data elements, record counts, dates)? Is our data encrypted at rest? When was your last independent security assessment?
- Write a one-page vendor breach runbook. Name who takes the vendor’s call, who contacts counsel and your insurer, who decides on notification, and who owns customer communication.
This quarter
- Fix contracts at renewal. Add notification timelines, required notice content, and cooperation duties that line up with Missouri’s “immediately following discovery” standard.
- Reduce what you share. Stop sending data vendors do not need, and delete old exports sitting in file transfer tools and shared folders.
- Close dormant connections. Remove vendor accounts, integrations, and remote access that are no longer in use.
- Ask your insurance broker how your cyber policy treats an incident that begins at a vendor, and what documentation the insurer expects from you.
Where InfiniTech can help
Two parts of this work line up with services we already provide. InfiniCare managed IT services include dark web monitoring for compromised credentials and personal information, a useful signal when data leaks from a supplier rather than from your own systems, and routine on-site assessments covering network and security posture, a practical moment to review which vendors connect to your environment. The InfiniCare Advanced Security Bundle adds multifactor authentication (MFA) across applications and 24/7 Managed Detection and Response (MDR) covering endpoints, servers, Microsoft 365, and firewalls.
Conclusion
You can outsource the work, but you cannot outsource responsibility for the data. The organizations that handle a supplier’s breach well will be the ones that already know which vendors hold their most sensitive records, what those vendors owe them, and who in the building picks up the phone.