At A Glance
At a glance A third-party breach occurs when a vendor, supplier, contractor or other business partner is compromised, and the incident exposes your organization’s data, systems or operations. Because partners may store information or connect to internal systems, their incident can become your business risk. A clear response plan helps you assess exposure, contain access, communicate accurately and support affected people.A third-party breach is an incident at an outside organization, or within a product or service it supplies, that compromises information, system access or services used by another organization. The outside party may be a vendor, supplier, business partner, contractor, cloud provider or software provider. A supply chain incident can travel further when the affected vendor supports several organizations or when compromised software is distributed to customers.
The event can involve unauthorized access to customer or employee data, stolen vendor credentials, a compromised software update, a misconfigured cloud service, ransomware at a supplier or an outage that interrupts a critical service. The defining issue is the connection: an organization’s information or business operations are exposed through a relationship with another party.
Why can a vendor breach affect your organization?
A vendor may hold personal information on your behalf, connect to your systems or provide a service your operations depend on. If the vendor is compromised, your organization may need to determine whether data was accessed, whether credentials or integrations remain secure and whether customers or employees are at risk. The incident can also lead to business interruption, investigation and recovery costs, contractual disputes, regulatory scrutiny and reputational damage.
The impact depends on what the provider could access and how the incident unfolded. An outage at a noncritical service may be inconvenient; a compromise involving customer records, payment workflows or identity data may require immediate investigation and customer support. The incident can also create a second wave of risk: exposed information may be misused in scams, account takeover or third-party fraud.
How can organizations prepare for third-party incidents?
Data breaches are on the rise, with The Identity Theft Resource Center (ITRC) recording 1,803 data compromises in the first half of 2026 alone. Preparation starts before an incident. Map the vendors and services that handle sensitive data or support important operations, and document what information each receives, where it is stored, how it is accessed and which subcontractors are involved. Prioritize providers based on the sensitivity of the data and the importance of the service, then review access and security expectations throughout the relationship.
Practical steps include:
- Limit access to what is needed: Use named accounts, multifactor authentication where available, least-privilege access and time-limited access for support or maintenance. Remove credentials and integrations promptly when they are no longer needed.
- Set incident expectations in writing: Contracts and operating procedures should define who contacts whom, what initial facts the vendor should provide, how evidence will be preserved, how updates will be shared and how the vendor will support your investigation. Legal and procurement teams should review terms for the applicable relationship and jurisdiction.
- Know your data flows: Keep an up-to-date record of the personal and business data shared with vendors, including data types, approximate volumes, storage locations and retention periods. This makes it easier to identify possible exposure when a provider reports an event.
- Exercise the response plan: Include vendors and internal owners from security, privacy, legal, communications, customer service and business operations in tabletop exercises. Test an incident notification, escalation path and service-continuity plan.
- Reassess important relationships: Review access, data handling, subcontracting and incident readiness when the service or vendor changes or new risks emerge.
What should you do when a vendor reports a breach?
Treat the notification as a starting point for a coordinated investigation. Record when and how the vendor notified you, open an incident record and activate the relevant internal leads. Ask the vendor for a clear timeline, the affected systems and services, the data types involved, the people potentially affected, the containment actions taken, the forensic findings available so far and the next update time. Distinguish confirmed facts from open questions and keep a record of decisions.
Then assess and contain risk:
- Identify your connection to the incident: Determine which systems, data stores, integrations, accounts and business processes use the vendor. Confirm whether your organization’s data was involved and whether the vendor’s access is still active.
- Prioritize exposure: Establish what information may have been accessed or acquired, whose information it was, how many people may be affected and what the information could enable. Consider whether the incident is ongoing and whether other vendors or subcontractors are involved.
- Contain access safely: Work with the vendor and your security team to disable or rotate affected credentials, restrict integrations, isolate affected systems or pause data transfers as appropriate. Preserve relevant logs and evidence; coordinate changes with forensic responders so containment does not unnecessarily destroy information needed to understand the incident.
- Protect operations: Determine whether to activate continuity plans, use an alternate provider or temporarily change a workflow. Set a cadence for internal updates and vendor status reports.
- Meet applicable obligations: Engage legal, privacy and compliance teams to assess notification duties, contractual commitments, law enforcement coordination and any sector-specific requirements. Requirements can vary by jurisdiction, data type and organization, so confirm them with qualified counsel.
How should you communicate with customers?
Communicate promptly, clearly and consistently, based on verified facts. If the investigation is still underway, say what is known, what is not yet known and when people can expect an update. Avoid speculation or minimizing language. Coordinate timing and content with legal counsel, the vendor and relevant authorities when needed, while ensuring customers receive useful information without unnecessary delay.
A strong customer notice should explain, in plain language:
- What happened and when, to the extent confirmed
- What types of information may have been involved
- What the organization has done to investigate and contain the issue
- What steps affected individuals can take based on the information involved
- What support is available and how to reach a dedicated contact
- How the organization will share future updates, including how to identify genuine messages from it
Prepare customer service teams with approved talking points, escalation routes and answers to likely questions. A dedicated incident page, email updates, call center support or other accessible channels can help people find consistent information. The Federal Trade Commission (FTC) recommends clear notices that explain the incident, actions taken, steps individuals can take and where to get more information. Tailor advice to the data involved and avoid offering the same remedy for every incident.
How can breach response services support affected individuals?
A third-party incident can leave an organization balancing investigation and remediation while still needing to respond to customers quickly. Data breach response services can help coordinate notification, provide call center support and offer identity protection or recovery services when appropriate to the exposure. These services can give affected individuals a clear way to understand the incident and take practical next steps, while helping the organization manage a consistent response.
The right support depends on what happened and what information was involved. Exposed identity data may call for different guidance than an interruption to a business service. Organizations should match services to the likely risk, communicate what is included and make it easy for people to get help. A broader identity risk management approach can also connect prevention, detection and support for people affected by identity-related risks. Where digital account access is relevant, online identity verification can be part of an organization’s broader effort to recognize legitimate customers and manage identity risk.
Partner with us for data breach response
A vendor incident can quickly become a test of how well an organization coordinates its response and supports the people who depend on it. Our data breach response services include customized response planning and support such as customer notification, call center services and identity protection. Our team can work with organizations to execute a response program aligned to their needs.
Learn how your organization can prepare to respond, communicate with affected individuals and help protect customer trust when an incident occurs.
