Vendor Data Incidents Account for 69% of All Breach Victims
Cybersecurity incidents at vendors can have a massive impact, as they frequently result in unauthorized access to the data of many, and sometimes all, of their downstream clients. Cybercriminals are well aware that a successful attack on a vendor can provide them with access to huge volumes of data, and they are often targeted for that reason. A new report from the global financial and risk advisory solution provider Kroll shows the impact of these incidents.
The Kroll Data Breach Outlook 2026 report is based on incidents handled by the firm between June 2025 and June 2026, and involved surveys of 250 risk/compliance leaders and C-suite executives/board members. The report shows that 69% of organizations experienced a data breach in the past year, with more than one-third (34%) experiencing more than one data breach.
Finance topped the list in terms of data breaches, followed by professional services, while healthcare placed third, having dropped from first position in 2025. Healthcare now accounts for 15% of Kroll-handled data breaches, and this year is the first time since 2022 that healthcare has not ranked in first or second place for data breaches. Overall, while technology ranked 7th in terms of the number of organizations experiencing a data breach, the sector accounted for 60% of affected individuals, followed by 10% in insurance, 8% in finance, and 8% in healthcare.
Drilling down into the data, the report shows the massive impact of third-party breaches. Out of all individuals affected by a data breach, 69% were affected by a third-party/vendor data breach. Out of those third-party breaches, 79% of affected individuals were affected by a data incident in the technology sector, followed by finance (9%), insurance (6%), and healthcare (5%). While the finance and technology sectors may be more susceptible to data breaches, the figures show the domino effect of a data breach in the technology sector, which can affect far more individuals due to the volume of data stored by the companies.
“Across most of the major incidents we handled over the past year, a vendor, software supplier or service provider was the link between the initial breach and the organizations affected. One incident can reach businesses and individuals who have never dealt directly with the company where the compromise began,” said Denyl Green, Kroll’s global head of breach notification.
While not included in the report, the current healthcare data breach figures for 2026 (January 1 to September 30, 2026) show that out of the 593 large data breaches reported so far this year to the HHS Office for Civil Rights (OCR), 79% occurred at HIPAA-covered entities and 21% of breaches occurred at business associates; however, business associate data breaches account for 41% of all affected individuals.
Kroll conducted an external survey that revealed that 54% of IT and technology leaders ranked vendors/third parties as their biggest compliance risk, far more than the C-suite (39.7%) and dedicated risk and compliance leaders (30.4%), which Kroll suggests is due to the people closest to the vendor relationship having the best understanding of risk.
