If your personal data turned up in a breach this year, there is a good chance the company that lost it was not one you ever did business with. Kroll's Data Breach Outlook 2026, released Oct. 22, covers the breach cases the risk and incident-response firm handled between June 2025 and June 2026. It found that 69% of affected individuals were impacted by a third-party breach, meaning the data was lost by a supplier or service provider and not by the organization the person actually dealt with.

Help Net Security, covering the report today, put it simply: breach victims are finding out their data was held by companies they have never heard of. That matters for consumers. It matters more for the people who have to defend organizations, and for the insurers who pay out when things go wrong.

Technology vendors carry most of the people

The report's main finding is a mismatch between how often a sector gets breached and how many people each breach affects.

Of the individuals affected by third-party breaches, Kroll attributes 79% to breaches in the technology sector. Finance accounted for 9%, insurance for 6% and healthcare for 5%. Seen across all of Kroll's cases, technology companies made up only 6% of breach cases but 60% of affected individuals, according to Help Net Security's reading of the report.

These two figures measure different things. The 79% figure covers only people hit through third parties. The 60% figure covers everyone affected in Kroll's caseload. Both point the same way: technology firms are not the most frequently breached organizations, but they sit upstream of many other businesses. When one of them is breached, the data of every customer's customers can go with it.

Insurance shows the same pattern. Insurance Business reported that in Kroll's June 2025 to June 2026 data, insurance ranked ninth by number of organizations breached, at 5% of breaches, but second by number of individuals affected, behind only technology. Insurers hold large amounts of policyholder data, and much of it passes through outside platforms and service providers.

Help Net Security pointed to the MOVEit file-transfer attacks as an illustration. Organizations were exposed through their own use of the software and through vendors that used it to handle their information, and subcontractors can extend the chain further when a supplier hands its clients' data to another company. Separately, Kroll's case data showed financial services accounted for the largest share of organizations breached, at 20%.

What the survey adds

Alongside its case data, Kroll surveyed 250 leaders. Their answers suggest breaches are routine:

  • 69% said their organization had been breached in the past year, and 34% said it had happened more than once.
  • 41% cited dependence on vendors as one of their top four challenges in making breach-response decisions. Help Net Security summarized this as around four in ten.

The survey also shows a split inside organizations over how seriously to take vendor risk. 54% of IT leaders named vendor breaches as their biggest compliance risk, compared with 40% of C-suite executives and 30% of risk leaders. The people closest to the systems are the most worried about the suppliers attached to them. The people who set budgets and own the risk register are less so.

The insurance problem: aggregation

Kroll's insurance practice puts the issue most sharply. Katherine Keefe, the firm's Global Cyber Insurance Industry Lead, told Insurance Business that a vendor or platform compromise "produces dozens, sometimes hundreds of claims filed by unrelated policyholders who share nothing but a common vendor."

Insurers call this aggregation risk. Cyber insurance pricing assumes, roughly, that one policyholder's bad day is independent of another's. A shared supplier breaks that assumption. Hundreds of businesses that look unrelated on paper can all file claims in the same week because they used the same payroll processor, file-transfer tool or software platform. Keefe made the same point in Kroll's release, saying a single supplier breach can trigger dozens or even hundreds of cyber insurance claims.

Keefe said underwriters are responding, as Help Net Security reported, by looking more closely at how applicants manage their suppliers, and at single points of failure that would put many policyholders at risk at once. In practice, expect renewal questionnaires to ask more about which vendors you depend on and what happens if one of them goes down or leaks.

What It Means for Defenders

This is not a vulnerability report. There is nothing to patch and no fixed version to install. The report's message is about visibility. In Kroll's case data, 69% of affected individuals were hit through a third party, so a large share of the exposure sits in someone else's systems. The mitigations follow from that.

Who is affected: Almost everyone who hands data to an outside provider. Kroll's figures point especially to organizations that rely on technology vendors and platforms. They also point to insurers and financial services firms, which show up heavily both as breach victims and as holders of other people's data.

Map your vendors and where your data goes. The aggregation problem Kroll describes starts with not knowing which suppliers hold your data. Keep an inventory of every vendor that stores or processes personal or sensitive data. Where you can, include the subcontractors they hand that data to. The MOVEit attacks showed that exposure can also run through vendors and subcontractors that handle data on your behalf.

Find your single points of failure. Underwriters are already looking for these, so it is worth finding them first. If one platform carries data for most of your customers, or if many business units depend on one provider, treat that provider as critical infrastructure. Give it matching scrutiny, contract terms and incident plans.

Plan breach response around vendors. Around four in ten of Kroll's respondents named vendor dependence among their top four breach-response challenges. Make sure contracts set out how quickly a supplier must tell you about an incident, what logs and details they will share, and who handles notifying affected individuals. Agree on this before an incident happens.

Close the gap between IT and leadership. The survey shows IT leaders worry far more about vendor breaches than executives or risk teams do. Kroll's case data, in which most affected individuals were hit through third parties, is consistent with the IT view. Defenders should bring these numbers to whoever owns third-party risk and budget.

Review your cyber insurance. Check whether your policy covers incidents that start at a vendor. Expect underwriters to ask more about supplier management at renewal. Clear documentation of your vendor inventory and controls will help there.

For federal contractors working through CMMC, the same discipline applies. Knowing which outside providers touch your sensitive data, and holding them to defined security and notification expectations, is the kind of supply-chain visibility that Kroll's findings suggest matters.

Sources