Third-Party Data Breaches Now Hit Most Victims

The breach most likely to land on your desk next starts inside a company you do not own. Your logo is on the notification letter, your name is in the regulator’s inbox, and your board wants to know why a vendor’s mistake became your incident. Kroll’s Data Breach Outlook 2026 puts a number on that pattern. Of the individuals affected in the breaches Kroll worked from June 2025 to June 2026, 69 percent were hit through a third party.

That figure deserves more attention than the usual vendor-risk reminder. It describes people, not incidents, and it shows where the real damage concentrates. A single compromised technology provider can reach millions of individuals across hundreds of customers at once. The security team of any one customer never saw it coming, and none of them controlled the systems that failed.

This post unpacks what Kroll measured, why it differs from the Verizon Data Breach Investigations Report, what the HIPAA notification rules say when a vendor is breached, and which evidence a CISO or compliance chief should hold before the phone rings. The short version is that a vendor questionnaire is not evidence. A log of what moved, who touched it and under which policy is.

Key Takeaways

1. Kroll found that 69 percent of affected individuals were hit through a third party, and 79 percent of those cases traced back to technology vendors.

2. Kroll counts people and Verizon counts breaches, so the two numbers measure different things and should never be blended into one statistic.

3. Under HIPAA, a business associate’s breach does not remove the covered entity’s duty to notify individuals, and the clock can start when the vendor is treated as an agent.

4. The leader gap is the hidden risk, because Kroll’s survey shows IT leaders far more confident than the C-suite or risk and compliance leaders.

5. The strongest defense is evidence you generate yourself, which means one governed path for sensitive content with one policy engine and one audit log.

What Kroll Measured

Start with the definitions, because the headline travels faster than its fine print. Kroll published its Data Breach Outlook 2026 on October 22, 2026. The casework behind it runs from June 2025 to June 2026. Kroll’s press release states that 7 out of 10 individuals hit by data breaches were reached via a third party, and the precise figure is 69 percent.

Notice the unit of measure. Kroll is counting affected individuals, meaning the people whose data was exposed. It is not counting the number of organizations that suffered a breach. That distinction matters because a vendor breach multiplies. One incident at a payroll processor, a claims platform or a file transfer provider can expose the customers of every client that used it.

Kroll also ran a survey of 250 leaders alongside its casework. Sixty-nine percent of those leaders said their organizations had been breached, and 34 percent said they had been breached more than once. A second 69 percent appears here, and it is easy to mistake for the first. One describes individuals reached through vendors. The other describes organizations that experienced a breach. Quote them separately, every time.

Kroll’s summary does not split its results by country. Treat the figures as a global pattern, not a ruling on any single market. If you are briefing a board in London, Riyadh or Chicago, say so up front and let the local regulatory section carry the regional weight.

Technology Vendors and the Blast Radius

Of the individuals affected through a third party, Kroll attributes 79 percent to technology vendors, 9 percent to finance, 6 percent to insurance and 5 percent to healthcare. The technology sector alone is linked to 60 percent of all affected individuals in Kroll’s dataset.

Look closer and the ranking tells a sharper story. Technology ranked seventh by the number of organizations breached, yet first by the number of individuals affected. Insurance ranked ninth by organizations and second by individuals. Those sectors are not breached more often than everyone else. They hold more of everyone else’s data, so each breach reaches further.

That is a concentration problem, not a carelessness problem. Your suppliers are not necessarily worse at security than you are. They are simply aggregation points. When a provider stores, routes or processes data for hundreds of customers, an attacker who gets in once collects a harvest that would otherwise take hundreds of separate intrusions.

Kroll also noted that finance and professional services each accounted for 20 percent of breaches, with professional services up 45 percent. Law firms, consultancies, accounting practices and outsourced specialists sit in the middle of sensitive exchanges. They receive contracts, financial records and personal data, and they pass them along. Every one of those handoffs is a place where your policy stops and someone else’s begins.

If your supply chain risk management program mostly asks vendors to describe their controls, it measures intent. Kroll’s numbers measure outcomes, and the outcomes concentrate in a handful of provider categories your program should rank first.

Verizon Counts Breaches, Kroll Counts People

Security leaders will quickly reach for the Verizon 2026 Data Breach Investigations Report to cross-check the Kroll story. The Verizon report found third-party involvement in 48 percent of breaches, up from 30 percent in the prior edition. Its window runs from October 2024 to November 2025 and covers 145 countries.

At first glance, 48 percent and 69 percent look like they disagree. They do not. Verizon asks how many breaches involved a third party. Kroll asks how many people were affected through one. Because third-party incidents tend to be larger, the share of people exceeds the share of breaches. Both figures can be true at the same time, and together they say more than either does alone.

Read together, they show two trends. Third-party involvement in breaches is rising quickly, and the breaches that involve a third party are bigger. A CISO who tracks only incident counts will underestimate exposure. A CISO who tracks only affected individuals will miss how routine the pattern has become.

Black Kite’s 2026 Third-Party Breach Report adds a useful warning about the evidence vendors usually provide. It logged 136 events, 719 named victims and roughly 26,000 unnamed ones, with a median disclosure lag of 73 days. Its average vendor grade was 90.27, yet 53.77 percent of those vendors still had a critical vulnerability. A strong score and a serious weakness lived in the same population. That is why a rating alone cannot stand in for proof of how your data was handled.

The Leader Gap Nobody Owns

The most revealing slice of Kroll’s survey is not about attackers. It is about confidence. When Kroll asked leaders how well prepared they felt, 54 percent of IT leaders said they were confident. Among the C-suite, 40 percent said so. Among risk and compliance leaders, only 30 percent did.

Read that spread as a signal about who holds the evidence. The people closest to the technology feel the most secure, and the people who must answer to regulators, insurers and boards feel the least. Compliance leaders are not being pessimistic. They know what an auditor will ask for, and they know the answer usually lives in a vendor’s system rather than their own.

Kiteworks’ own annual survey points the same direction. Of 459 respondents, about half in the EU and UK and all self-reported, only 14 percent named a third-party breach as their top risk. Meanwhile 54 percent use four or more platforms to exchange sensitive content, and 73 percent have no technical enforcement on those channels. Just 4 percent run a single unified platform, and 19 percent have never tested whether third-party access can actually be revoked.

Pause on that last number. One in five organizations has never confirmed that it can turn a vendor’s access off. If your vendor is breached on Tuesday, the first question from your CEO will be whether you can cut the connection. “We believe so” is not an answer a board will accept, and it is not one an investigator will record kindly.

Call this the evidence gap. It is the distance between the confidence your technology team reports and the proof your compliance team can produce on demand. Kroll’s three numbers, 54, 40 and 30, are a map of that distance.

The Notification Duty Does Not Move

Healthcare makes the liability concrete, because HIPAA spells out who must tell whom. Under 45 CFR 164.410, a business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 calendar days after discovery. The rule also says a breach is treated as discovered when the business associate knows of it, and when any of its workforce members or agents knows of it.

Now look at the next link in the chain. Under 45 CFR 164.404, the covered entity notifies the affected individuals. The vendor’s failure does not transfer that duty. You are still the organization patients hear from, and you are still the one whose notification letters regulators read.

HHS addressed a subtle point in its 2013 commentary in the Federal Register. If a business associate acts as the covered entity’s agent, the business associate’s knowledge of a breach is imputed to the covered entity. In that situation the covered entity’s own notification clock may begin when the vendor discovers the breach, not when the vendor finally picks up the phone. Whether a vendor is an agent depends on how much control you exercise, so it is a legal question worth settling with counsel before an incident, not during one.

This is also where the HIPAA Security Rule overhaul enters the conversation. The proposed update has not been finalized, and reporting from HIPAA Journal indicates that final action has slipped to July 2027. Do not wait for it. The notification rules above already apply, and your vendor evidence should be ready now. For deeper background on the baseline, see Kiteworks’ overview of HIPAA compliance.

The same logic travels beyond the United States. Under UK GDPR Article 33, a controller must notify the regulator within 72 hours of becoming aware of a breach, where feasible. Saudi Arabia’s PDPL also runs on a 72-hour notice to its regulator, and a consultation that opened October 6, 2026 proposes tightening it. Coverage from Pinsent Masons reports that the draft would remove the current harm threshold, require in-Kingdom storage and add a 20-business-day response duty. The consultation closes November 5, 2026, and these details come from secondary sources, so check the primary text before you act on them. The pattern is the same in every jurisdiction. The vendor may cause the breach, but the controller carries the clock.

The Insurance Math

Insurers have noticed the same pattern. Reporting in Insurance Business found that vendors caused most of June’s biggest health data breaches. When the largest incidents in a sector routinely begin with a supplier, underwriters will start asking suppliers’ questions about you.

Expect a few shifts. Applications will probe how you inventory vendors that hold your data. Renewal conversations will ask whether you can show who accessed what, not merely whether a policy exists. Claims will turn on whether you can reconstruct events quickly, because a claim you cannot document is a claim you may not collect.

Insurance also sits in a peculiar spot in Kroll’s data. It ranked ninth by organizations breached and second by individuals affected. Carriers and their administrators are aggregators too, which means the party that prices your risk is exposed to the same concentration effect you are.

The practical lesson is that the cost of a vendor breach is not set by the vendor. It is set by how fast you can answer four questions. What data did that vendor hold? Who authorized the access? What was shared in the last 90 days? Can you prove it? Each answer either comes from your own records or from a vendor’s goodwill.

Evidence Before the Vendor Calls

Most organizations treat third-party risk as a procurement function. They send a questionnaire, collect a SOC 2 report, file the results and move on. That process has value, but it produces claims about the vendor’s environment. It does not produce evidence about your data’s movement.

The distinction decides what you can do on the worst day. A vendor-supplied attestation tells you what the vendor says it does. Your own audit logs tell you what happened to your content. During an incident you will rely on the second source far more than the first, and a regulator will, too.

This is where the architecture of sensitive content exchange matters. Email, file sharing, SFTP, managed file transfer, web forms and APIs are the routes through which regulated data leaves your walls. If each route has its own tools, its own policies and its own logs, assembling an incident timeline becomes a forensic project. Kiteworks’ survey numbers show how common that fragmentation is, with 54 percent of respondents running four or more platforms.

A control plane approach consolidates those routes. Kiteworks governs secure email, secure file sharing, SFTP, managed file transfer, forms and APIs through one data policy engine, with RBAC and ABAC controls, a single audit log and a defensible chain of custody. It runs as a single-tenant hardened virtual appliance, so your data and your keys are not mingled with another customer’s. AI agents are governed alongside human users under the same policies, which matters as more vendor workflows are automated.

The principle behind it is simple. When something goes wrong at a vendor, the question is not what the vendor knew. It is what you can prove about the content you sent to the vendor, and under which rules. A governed path answers that in minutes instead of weeks.

The HIPAA minimum necessary rule belongs in this discussion too. Sending less data to a vendor reduces how many individuals can be affected if that vendor falls. Kroll’s concentration finding and the minimum necessary principle point the same way. Limit what leaves, and what leaves should be policy-controlled and logged.

Five Moves for the Next 90 Days

A finding like Kroll’s can feel too large to act on. It is not. Five moves fit inside a quarter and each produces something you can show an auditor.

Move 1. Rank vendors by data volume, not by contract value. Build a list of every third party that holds regulated or confidential content, then sort by how many individuals or records they hold. Kroll’s data says the technology and insurance categories deserve the first pass. Your highest-spend vendor and your highest-exposure vendor are rarely the same company.

Move 2. Test revocation, not just policy. Pick your five riskiest vendors and cut their access in a controlled exercise. Record how long it took, who was involved and what broke. Nineteen percent of surveyed organizations have never done this, and it is the cheapest way to leave that group.

Move 3. Settle the agent question with counsel. Decide, vendor by vendor, whether the relationship could be read as an agency. If it could, the HHS commentary says the vendor’s knowledge may become yours. Your incident response plan should state when the notification clock starts under each reading, and it belongs in your incident response plan.

Move 4. Close the leader gap with one shared exhibit. Put the IT view and the compliance view on one page. Show which third-party exchanges are enforced by technical controls, which rely on policy alone and which have no logging. When 54, 40 and 30 become a single list of named gaps, the confidence spread turns into a work plan.

Move 5. Consolidate the channels that carry regulated data. Map every path used to move sensitive content to or from a third party. Retire the ones nobody governs. Move the rest under a single policy engine and a single log, so that the next incident timeline is a report rather than an investigation. For related programs, see Kiteworks’ guidance on vendor risk management and TPRM.

Do these five things and your next board conversation changes. Instead of explaining how a vendor failed you, you can show what you knew, what you controlled and how quickly you responded.

What to Tell Your Board

When directors ask about the Kroll headline, give them three sentences. Most people harmed by breaches are harmed through suppliers, not through the company whose name is on the letter. Our legal duty to notify stays with us even when the vendor is at fault. Our defense is the evidence we hold, and we are measuring and improving it on a schedule.

Then bring the exhibit. A list of vendors ranked by exposure, a result from a revocation test and a single timeline of one sensitive exchange, start to finish, will do more than any maturity score. Boards trust what they can inspect.

One last caution about scope. Kroll’s casework is a global sample, and Kiteworks’ survey respondents are self-reported and skew toward the EU and UK. Neither dataset predicts what will happen to your organization. They do show that the structure of the risk has shifted, and that structure rewards the organizations that can document their own handling of data.

See It on Your Own Data

Kiteworks gives security and compliance teams one governed path for sensitive content, with one policy engine and one audit log across email, file sharing, SFTP, managed file transfer, forms and APIs. If you want to see what a vendor-breach timeline looks like when the evidence is already in one place, schedule a custom demo today.

Additional Resources

• Blog Post Zero Trust Architecture: Never Trust, Always Verify
• Video Microsoft GCC High: Disadvantages Driving Defense Contractors Toward Smarter Advantages
• Blog Post How to Secure Classified Data Once DSPM Flags It
• Blog Post Building Trust in Generative AI with a Zero Trust Approach
• Video The Definitive Guide to Secure Sensitive Data Storage for IT Leaders