Third-party data breaches accounted for more than two thirds of affected individuals in incidents investigated by Kroll over a 12-month period. Technology company compromises were responsible for most of those downstream exposures.
The findings, published in Kroll’s Data Breach Outlook 2026 on 22 October 2026, illustrate how one incident at a widely used technology provider can affect people across numerous customer organisations. They describe a concentration of risk rather than a single vulnerability, product flaw or active malware campaign.
Third-party data breaches dominated Kroll cases
Kroll analysed incidents it handled between June 2025 and June 2026. It found that 69% of affected individuals were impacted through third-party data breaches, rather than through a direct compromise of the organisation with which they had a relationship.
Within that third-party group, 79% of affected individuals had their data exposed through compromises involving technology companies. This made technology suppliers the dominant source of downstream harm in Kroll’s observed cases.
The technology sector also accounted for 60% of all individuals affected across the dataset, including both direct and third-party incidents. The figures indicate that technology breaches can expose particularly large populations because suppliers may store data or provide services for many customers simultaneously.
However, the sector responsible for the greatest number of affected individuals was not the sector with the highest number of breached organisations. Finance represented the largest share of organisations breached by count, at 20%.
This distinction is important. Finance experienced more organisational breaches in Kroll’s dataset, but compromises involving technology companies produced a larger impact when measured by affected individuals. One technology provider incident can generate notifications across dozens or hundreds of customers.
Kroll also surveyed 250 leaders for the Data Breach Outlook 2026. The public report summary combines this leadership research with observations from incidents investigated during the June 2025 to June 2026 window.
How technology breaches create a domino effect
Kroll describes a domino effect in which the compromise of one vendor, software supplier or service provider cascades into multiple customer environments. Affected organisations may not have suffered an intrusion into their own networks, but data processed or held by the supplier can still be exposed.
This concentration effect helps explain why third-party data breaches can produce unusually high victim totals. A software-as-a-service provider, managed service provider or other technology business may support numerous organisations, each with its own employees, customers and data subjects.
A single supplier incident can therefore lead to several layers of impact:
- The technology provider investigates the initial compromise and identifies accessed systems or information.
- Customer organisations must determine whether their data was involved and which individuals may be affected.
- Multiple customers may need to issue notifications, answer enquiries and meet regulatory obligations.
- Individuals can receive breach notices from organisations whose systems were not directly attacked.
The public Kroll materials do not name affected vendors, products or software versions. They also do not connect the statistics to a particular CVE, threat actor or malware family. The findings should not be interpreted as an alert about one defective product.
Common routes into technology supply chains
Although Kroll’s public summary does not provide technical indicators, separate third-party risk research offers context for how these incidents can develop. File transfer software and the abuse of trusted partner credentials have repeatedly featured as enablers of supply chain compromises.
Attackers may exploit a weakness in software operated by a provider, steal credentials belonging to a supplier, or misuse legitimate access between connected environments. The supplier’s trusted position can then give the attacker access to customer data or provide a route into downstream systems.
Not every third-party event involves attackers moving directly from a vendor into a customer’s network. In many cases, the exposure occurs because the breached provider already stores, processes or transfers information on behalf of its customers.
This difference affects incident response. An organisation may have no malicious activity in its own security logs while still facing a reportable breach because its information was exposed at a processor or service provider.
Timeline of the Kroll third-party breach findings
The report covers a defined investigation period rather than a single incident. Its principal milestones are:
- June 2025 to June 2026: Kroll’s observation window for the incidents included in its analysis.
- 22 October 2026: Kroll published Data Breach Outlook 2026 and announced the headline findings.
- 23 October 2026: Wider reporting highlighted the concentration of third-party victims around technology companies.
No later exploitation update, patch release or product advisory applies to the report. Its current status is a statistical assessment of completed or investigated cases, not an ongoing campaign requiring organisations to search for one set of indicators.
Other research has identified a similar concentration of downstream exposure around technology and telecommunications providers, although those studies use different datasets, time periods and methodologies. Those differences mean sector rankings should not be compared directly, but they support the broader finding that widely connected suppliers can amplify the consequences of an intrusion.
Why the findings matter to UK organisations
The results show why counting supplier incidents alone can understate exposure. Technology providers may not experience the highest number of breaches, but their customer reach and data holdings can make each successful compromise more consequential.
UK small and medium-sized businesses often depend on software platforms, cloud services and managed technology providers that they could not easily replace. If one critical supplier is compromised, the business may need to investigate its exposure without having direct access to the supplier’s forensic evidence.
Third-party data breaches can also complicate notification decisions. Customers need timely details about what happened, which records were involved, when the compromise occurred and whether the attacker retained access. Delays or gaps in supplier reporting can make those decisions harder.
Actions following the third-party data breach report
Organisations should use the Kroll findings to prioritise suppliers according to the data and access they hold, not simply by contract value. Technology providers that process personal information, administer systems or connect directly to business networks deserve particular scrutiny.
- Identify which technology suppliers store sensitive data or hold privileged access.
- Check contracts for clear incident notification deadlines and investigation support requirements.
- Confirm how suppliers identify affected customers and provide forensic findings after a breach.
- Review whether trusted vendor access is limited, monitored and removed when no longer required.
- Prepare an incident process for supplier notifications, including legal, regulatory and communications decisions.
There is no specific patch associated with these findings. The practical response is to understand where supplier concentration exists and ensure critical providers can deliver the information needed if an incident occurs. Kroll’s figures show that third-party data breaches are not a peripheral risk: in its cases, they accounted for the majority of affected individuals.
Originally reported by Infosecurity Magazine.
