- Kroll says 69% of affected people in its cases were hit through a third party. Of those, 79% were affected by a breach in the technology sector.
- Technology ranked seventh by organizations breached in Kroll's cases but first by people affected, so counting breached companies understates supplier risk.
- Map which vendors hold your data or have access to your systems, and agree a notification plan before an incident.
Counting breached companies hides who is hurt
Rank sectors by companies breached, and you get one list. Rank them by people affected, and you get another. Kroll's Data Breach Outlook 2026, published on October 22, shows how far apart the two lists sit.
Kroll is a risk advisory firm. Its case data covers June 2025 to June 2026 and comes from the breach work of its cyber and data resilience unit. It also ran a survey of 250 risk and compliance leaders, senior executives and board members.
The idea is simple. Your exposure follows the firms that hold your data. It does not follow the sector you work in.
What Kroll found
Kroll says 69% of affected individuals in its cases were hit through a third-party breach. Of those people, 79% were affected by a breach in technology. Finance accounted for 9%, insurance for 6% and healthcare for 5%.
Now count organizations instead. Infosecurity Magazine, reporting on the findings, says finance and professional services each made up 20% of the breaches Kroll saw. Healthcare made up 15% and retail 8%. Technology made up just 6%.
Yet Infosecurity reports that technology firms were behind 60% of all breach victims in the period. Insurance followed at 10%. Finance and healthcare each had 8%, and education 7.5%. Kroll notes that insurance ranked ninth by organizations breached but second by people affected.
One limit applies. These figures describe Kroll's own cases. They are not a count of every breach.
Why one supplier reaches so many
A technology provider runs software or services for many customers. It often holds their data or can reach their systems. One break-in can therefore touch all of them. Kroll says a single breach at such a provider can expose data from the customers of hundreds of businesses.
Denyl Green is Kroll's global head of breach notification. He says that in most major incidents Kroll handled this year, a vendor or service provider connected the first breach to the victims. One incident, he says, "can reach businesses and individuals who have never dealt directly with the company where the compromise began."
The workload then multiplies. Green says each client of a breached supplier must work out whose data was affected. Each must also decide whether customers and regulators need to be told. One supplier incident becomes many separate incidents.
Infosecurity points to two examples outside Kroll's data. It says the Scattered Spider group is known for going after IT service firms to get into their clients. It also notes an October 2026 report that a Chinese nation-state actor gained access to ConnectWise's cloud infrastructure, which let the group target downstream customers.
The insurer sees the same pattern
Katherine Keefe leads cyber insurance work at Kroll. She says one supplier breach can trigger "dozens or even hundreds" of insurance claims. The claimants may share only one thing: the same provider.
She says underwriters are already looking harder at how firms manage suppliers. They are also hunting for single points of failure, meaning vendors that serve wide parts of industry. Insurers, in other words, are studying the dependencies you may not have mapped.
IT leaders worry about vendors more than executives do
Kroll's survey shows that views differ by role. Asked to name their biggest compliance risk, 54% of IT and technology leaders chose vendor and third-party breaches. Among C-suite executives, 40% gave that answer. Among risk and compliance leaders, 30% did.
The survey does not say why the answers differ. It does show that the people closest to the systems rank supplier breaches higher than other groups do.
Vendors also make decisions harder during a breach. Kroll reports that 41% of respondents put vendor dependence among their top four challenges in breach response.
Green also points to AI. As agents gain access to systems and sensitive data, he says, breach risk rises for both human and non-human identities. Non-human identities are accounts, keys and software agents that act without a person logging in. Each one a supplier holds is access someone must track.
Questions to put to your team
Start with five questions. Which suppliers hold our customers' data or have access to our systems, and who owns that list? If a supplier is breached, who decides whether we are affected, and how fast will they tell us?
Do we have a notification plan, covering every jurisdiction we operate in, agreed before an incident? What non-human access, such as service accounts, keys or AI agents, have we given suppliers? Does our insurer know which vendors we share with other policyholders?
Green's advice is to map supplier relationships and their knock-on effects, and to agree a plan in advance. He says the firms that do this respond best. A breach table ranks the companies that were hit. Your risk follows the companies that hold your data.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Kroll.
