Your Vendor Got Hacked: What a Third-Party Data Breach Means for You, and the One-Hour Vendor Review

The claims company is in the news, and nobody called

The office manager of a three-location physiotherapy group in Abu Dhabi hears about it from her sister, who saw a headline on her phone. The company that submits the group's claims to insurers has been breached. Patient names, dates of birth, insurance IDs and diagnosis codes, going back years, possibly.

She checks her inbox. Nothing from the vendor. She checks the vendor's website. A banner says they are "aware of a security incident" and "working with leading experts." She calls the account rep, who is out of office until Monday.

The practice owner asks the obvious question: "Which of our patients are affected?" She cannot answer. Then he asks the harder one: "Who else has our patient data?" She starts a list on a legal pad. The claims company. The EHR company. The appointment-reminder texting service. The transcription vendor the new physical therapist uses. The payroll company, for staff. The IT firm that has admin access to everything. The cloud fax service. The marketing agency that once got a patient list for a mailer.

By the end of the hour the list has fourteen names, and she has a signed data protection agreement with six of them. She has never asked any of the fourteen a single question about their security. She has been told, in effect, that a stranger's password hygiene now determines whether her practice reports a breach to the Department of Health and writes to 9,000 patients.

What the heck does this mean

A third-party data breach is a breach at a company you do business with that exposes your data or your customers' data. You did nothing wrong, technically. You still get the phone calls.

A supply chain cyber attack is the same idea seen from the attacker's side: hit one vendor, reach every customer of that vendor. Breaking into 400 physiotherapy practices is hard. Breaking into the one claims processor they all use is a much better return on effort.

Vendor risk is the exposure you inherit from everyone who holds your data or has access to your systems. It includes the IT firm with the admin password and the intern's favorite file-sharing tool.

A guest account is a login your vendor's staff or a former contractor holds in your cloud tenant. Most businesses have dozens they have forgotten about, still active, still able to open the shared drive.

Here is the reframing that matters: your security perimeter is not your office. It is the sum of every company that can log in to your systems or hold your files, and most owners have never written that list down.

The numbers that matter

35.5% of publicly reported breaches in 2024 were third-party related, according to the SecurityScorecard 2025 Global Third-Party Breach Report. More than a third of the breach letters that went out that year came from a vendor's mistake, not the sender's.

98% of organizations have a relationship with a vendor that has been breached, in the same SecurityScorecard 2025 report. Read that as a certainty, not a risk. One of yours already has.

69% of monitored SaaS accounts in small and midsize business tenants were unmanaged guest accounts, per the Kaseya 2026 SaaS Security Report. Two out of three logins in the average small-business cloud belong to somebody nobody is watching.

What to do this week

1. Write the vendor list. One hour, one spreadsheet: vendor name, what data they hold, whether they have a login to your systems, and who at your company owns the relationship. Fourteen names on a legal pad is a good start. (CIS 15 Service Provider Management)
2. Mark the five vendors that could hurt you most if they were breached tomorrow, and send each one the five questions in the FAQ below. Give them two weeks. (CIS 15 Service Provider Management)
3. Pull the guest and external accounts from your cloud tenant and disable every one nobody can name. Do the same for the IT firm's admin accounts: are they named individuals, and do they have MFA? (CIS 5 Account Management)
4. Find out which vendors have full copies of your data and whether they need them. The marketing agency did not need every patient's date of birth for a postcard. Send less. (CIS 3 Data Protection)
5. Add a vendor breach to your incident plan: who calls the vendor, who determines which customers are affected, and where the contract's notification clause lives. (CIS 17 Incident Response Management)
6. Put a security clause and a breach-notification deadline in your standard vendor contract template, so the next agreement you sign has them without a fight. (CIS 15 Service Provider Management)

Where AccuSights fits

Our assessment builds the vendor list with you, ranks it by what each vendor could cost you, then checks the part you can see: guest accounts, admin logins, data copies nobody needed. The Cyber Hygiene Test takes three minutes and gives a starting score. If the vendor question keeps you up, 30 minutes with your Risk Assessor turns the legal pad into a plan.

We map your vendor controls to what the PDPL expects of a processor, and to your own regulator's supplier rules if you work in health or finance. The read-only compliance agent shows which third parties can reach your data and which of those reviews have gone stale. We have no access and do not remediate; you or your IT partner fix, we show you where.

You cannot control your vendor's security. You can control how much of your business you hand them, and whether you would find out first.