Data Breach Victims Uncover Their Data Held by Unknown Companies

More than 70% of individuals affected by data breaches were compromised through third-party vendors, according to a Kroll report.

Third-Party Vendors and Data Exposure

Organizations increasingly rely on external entities for data storage, transaction processing, and software operations. A security incident at a third-party vendor can expose customer information across multiple organizations, including individuals unaware of the entity holding their data.

Technology Providers and Multi-Client Risks

60% of affected individuals were impacted by breaches involving technology providers, which accounted for 6% of all breach cases. These companies often serve multiple clients, aggregating data from diverse industries. A single breach at such a provider can necessitate investigations by numerous organizations.

Subcontractors and Complicated Chains

Subcontractors further complicate the chain when suppliers engage other firms to handle data storage or processing. The MOVEit file-transfer attacks exemplify this dynamic, as organizations were affected through direct use of the software and via vendors employing it to manage their data.

Challenges in Breach Response

Investigating supplier breaches introduces complexities for affected entities. Each client must determine whether its data was involved, what specific information was exposed, and whom to notify. Coordination is required to assign responsibility for informing affected individuals.

Vendor Dependencies and Planning Challenges

Approximately 40% of respondents identified vendor dependencies as a significant challenge during breach response planning. For end users, notifications must clarify how an unfamiliar third party obtained their information, what details were compromised, and recommended mitigation steps.

Insurance Claims and Financial Risks

A single supplier breach can trigger dozens or hundreds of cyber insurance claims from organizations connected through shared service providers. This scenario significantly amplifies potential financial losses compared to breaches impacting individual entities.

Insurer Reassessments and Risk Management

Katherine Keefe, Global Cyber Insurance Industry Lead at Kroll, noted underwriters are reassessing how businesses manage vendor relationships to identify providers that could become single points of failure across multiple organizations. Cyber insurers now prioritize identifying dependencies on common vendors to evaluate and reduce risks.

“When multiple policyholders are affected, claims teams must coordinate incident response and breach notifications. The report underscores the growing importance of supply chain security in mitigating large-scale data exposure.”

Conclusion

The findings highlight the interconnected nature of modern data ecosystems, where breaches at one entity can create cascading effects across industries. Organizations must implement rigorous vendor management practices to address vulnerabilities that extend beyond their direct operations.