Breaches

Kroll: 69% of breach victims were hit via a third party

Kroll’s Data Breach Outlook 2026 finds 69% of affected people were exposed via a supplier, mostly tech firms. What it means for UK data controllers.

Network of connected organisations illustrating a single supplier breach spreading to many downstream businesses

Kroll’s Data Breach Outlook 2026 finds that almost seven in ten people caught up in the breaches it handled were exposed through a supplier, not through the organisation they actually dealt with. Technology providers sit behind most of that harm, even though they are breached far less often than banks or professional services firms.

What happened

On 22 October 2026 Kroll, the risk advisory firm, published its annual Data Breach Outlook, subtitled “The Third-Party Domino Effect”. The report combines two things: the twelve months of breach cases its Cyber and Data Resilience team worked on up to June 2026, and a 2026 survey of 250 board members, senior executives and risk and compliance leaders.

The headline figure is that 69% of the individuals affected in Kroll’s cases were affected by a third-party breach. Of those people, 79% were exposed because a technology company had been compromised. Breaches originating at finance firms (9%), insurers (6%) and healthcare organisations (5%) accounted for far smaller shares of the third-party total.

The survey also points to how common breaches have become. Of the 250 leaders Kroll questioned, 69% reported at least one breach over the past year and 34% reported more than one. Infosecurity Magazine, reporting on 23 October, noted that technology incidents caused 60% of all breach victims Kroll observed, ahead of insurance at 10%.

A word on scope before going further. Kroll’s figures are drawn from its own global caseload and survey, and the published material contains no UK-specific or regional breakdown. Everything below about what this means for UK organisations is my own analysis, not Kroll data.

The detail

The most useful part of the report is the gap between how often a sector is breached and how many people those breaches reach. Finance was the most frequently breached industry in Kroll’s caseload at 20% of incidents, with professional services also at 20%, a 45% rise on the previous year’s report. Healthcare followed at 15% and retail at 8%. Technology accounted for only around 6% of incidents and came seventh by number of organisations breached, yet it came first by number of people affected. Insurance shows the same pattern, ranking ninth for organisations breached but second for individuals.

The reason is simple: a software vendor, hosting platform or managed service provider holds data for many clients at once, so one intrusion becomes many notification exercises. Denyl Green, Kroll’s global head of breach notification, said that in most of the firm’s major cases a supplier of some kind sat between the original intrusion and the organisations that ended up affected.

Kroll’s survey also suggests a perception gap inside organisations. Some 54% of IT and technology leaders ranked supplier breaches as their top compliance worry, compared with 40% of senior executives and just 30% of those in risk and compliance roles. Reliance on vendors was a top-four obstacle to breach-response decisions for 41% of respondents. Kroll also flags AI agents with wide system access as a growing source of exposure.

The insurance angle matters too. Katherine Keefe, Kroll’s global cyber insurance industry lead, said a single vendor incident can generate a large wave of insurance claims from businesses whose only link is a shared provider, and that underwriters are scrutinising supplier management and shared single points of failure more closely.

Key figures from Kroll's Data Breach Outlook 2026: 69% of affected individuals hit via third parties, 79% of those via technology suppliers

Why it matters for UK organisations

UK organisations of every size lean heavily on outsourced IT, SaaS platforms and managed service providers. Under UK GDPR, the organisation that collected the data remains the controller even when a processor loses it. If your payroll provider, CRM vendor or hosting company is breached, the duty to assess risk, notify the ICO within 72 hours where required and tell affected people still lands on you. If you have never tested how quickly a supplier would tell you about a breach, and what it would say, Kroll’s findings on vendor dependence should worry you.

There is a regulatory direction of travel as well. The Cyber Security and Resilience Bill is designed to bring managed service providers into the UK’s NIS regime, which recognises the same concentration risk Kroll describes. Insurers are moving in parallel, and UK buyers should expect sharper questions at renewal about which suppliers hold their data and how those suppliers are assessed.

The survey’s perception gap also rings true: boards picture breaches as direct attacks, while the data points to someone else’s network as the likelier route.

Expert view

In my experience, supplier risk is the area where paperwork and reality drift furthest apart. Organisations send out security questionnaires, file the answers and rarely look again. When we test environments, the soft spots are often the integrations: a support vendor with standing remote access, an API key with far more scope than the integration needs, or a legacy SaaS connection nobody remembers approving. Those are exactly the paths a compromised supplier hands to an attacker.

The other recurring weakness is data minimisation. A processor cannot leak what it was never given. Many organisations send full customer records to vendors that only need a reference and an email address. Kroll’s numbers on technology breaches reaching huge populations are, in part, a measure of how much data we hand to suppliers by default.

I would add a note of caution on the figures themselves. They reflect the cases Kroll was hired to handle, which are likely to skew towards larger notification programmes, and the survey sample is 250 people. They show a pattern rather than the whole market, but it is one most practitioners will recognise.

What to do now

  1. Build a supplier data map. List every vendor that stores or processes personal data, what data they hold, where, and who your contact is in an incident. Kroll’s own advice is to map third-party relationships before an incident, not during one.
  2. Cut what you share. Review data flows to each processor and remove fields they do not need. Offboard dead integrations and make sure former suppliers have deleted your data.
  3. Lock down supplier access. Apply the Cyber Essentials user access control principles to third parties: named accounts, multi-factor authentication, least privilege and removal of standing remote access where possible.
  4. Audit integrations and tokens. Inventory OAuth apps, API keys and service accounts tied to vendors, rotate long-lived secrets and narrow their permissions. Include any AI agents given access to business systems.
  5. Fix the contract terms. Make sure processor agreements set a short, specific deadline for breach notification and require enough detail for you to meet your own ICO reporting duty.
  6. Rehearse a supplier breach. Run a tabletop exercise in which a key vendor is compromised, and time how long it takes to identify whose data is affected.
  7. Brief the board and broker. Check how your cyber policy treats losses that start at a supplier.

Bottom line

Kroll’s data says the breach most likely to reach your customers will start at a supplier, usually a technology one. For UK organisations the legal responsibility stays with you whoever was hacked, so knowing where your data sits, and cutting how much of it your suppliers hold, is now basic breach preparation.

Sources

Related Posts