Tech supplier breaches account for most victims in Kroll's cases
Finance has the most breached organizations in Kroll's caseload, but a compromise at one technology provider reaches far more people, and insurers are scrutinizing that shared exposure
- Method: Kroll's analysis of incidents handled by its Cyber and Data Resilience practice, June 2025 to June 2026, plus a survey of 250 risk and compliance leaders, C-suite executives and board members conducted in 2026
- Surveyed organizations breached in the previous 12 months: 69%, with 34% breached more than once
- Respondents citing vendor dependence among their top four breach-response challenges: 41%
- Largest share of organizations breached in Kroll's cases: financial services, at 20%
The exposed are businesses that share a software supplier, vendor or service provider, and the individuals whose data those businesses hold – people who, in Green's account, may never have dealt directly with the company where the compromise began. A mid-market firm that relies on a few widely used suppliers is exposed to any breach at those suppliers, alongside every other client they serve. In Kroll's description, each affected client then has to establish whose data was involved and whether customers and regulators are notified.
“Kroll's breach data shows a single supplier breach can trigger dozens or even hundreds of cyber insurance claims from businesses whose only connection is that they use the same provider.”Katherine Keefe, global cyber insurance industry lead, Kroll
Sixty-nine percent of the individuals affected by data breaches that Kroll handled between June 2025 and June 2026 were hit through a third party, according to the firm's Data Breach Outlook 2026, published on 22 October. The research is Kroll's own: the company sells breach response and notification services, and the report draws on its case files and a survey it ran.
Of those third-party victims, 79% were caught up in a breach at a technology company. Breaches in finance, insurance and healthcare accounted for 9%, 6% and 5% respectively. Technology ranked seventh by the number of organizations breached and insurance ninth, yet the two sectors were first and second by the number of individuals affected.
More than half (54%) of IT and technology leaders in the survey named vendor and third-party breaches as their biggest compliance risk, against 40% of C-suite executives and 30% of risk and compliance leaders.
Denyl Green, global head of breach notification at Kroll, said that across most of the major incidents the firm handled in the year, a vendor, software supplier or service provider was the link between the initial breach and the organizations affected. In his account, the businesses that respond most effectively have already mapped their third-party relationships and agreed a plan before an incident happens.
Sources
- Kroll, “7 out of 10 Individuals Hit by Data Breaches Via Third Party, Kroll Finds”, press release, 22 October 2026. https://www.kroll.com/en/newsroom/7-out-of-10-individuals-hit-by-data-breaches-via-third-party
- Kroll, “7 out of 10 Individuals Hit by Data Breaches Via Third Party, Kroll Finds”, PR Newswire, 22 October 2026. https://www.prnewswire.com/news-releases/7-out-of-10-individuals-hit-by-data-breaches-via-third-party-kroll-finds-302916295.html
- Infosecurity Magazine, “Attacks on Tech Firms Behind Most Third-Party Data Breach Victims”, James Coker, 23 October 2026. https://www.infosecurity-magazine.com/news/tech-third-party-breach-victims/
