Most people hit by data breaches were exposed through a vendor

Most people whose data was exposed in a breach were not hit through the company they trust. They were hit through one of its vendors. A new report from risk advisory firm Kroll finds that 69% of all individuals affected by a data breach were affected through a third-party or vendor breach.

What the report found

Kroll's Data Breach Outlook 2026 covers incidents the firm handled between June 2025 and June 2026. It also surveyed 250 risk and compliance leaders, senior executives and board members. In that group, 69% of organizations had a data breach in the past year, and 34% had more than one. That is a separate 69% from the one about vendors.

Finance had the most breaches, followed by professional services. Health care came third and now makes up 15% of the breaches Kroll handled. It was first in 2025.

Why tech vendors matter so much

Technology ranked only seventh for the number of organizations breached. Yet the sector accounted for 60% of affected individuals. Of the people hit through vendor breaches, 79% were affected by an incident in the technology sector. Finance was next at 9%, then insurance at 6% and health care at 5%.

The reason is scale. Tech companies store huge amounts of data for many clients, so one break-in can reach a lot of people at once. Denyl Green, Kroll's global head of breach notification, said one incident can reach businesses and individuals who never dealt directly with the company where the compromise began.

The health care picture

The report does not cover this, but current health figures point the same way. From January 1 to September 30, 2026, 593 large breaches were reported to the federal Office for Civil Rights. Of those, 79% happened at health providers and plans. 21% happened at business associates, the outside companies that handle data for them. Yet those business associate breaches account for 41% of all affected people.

What to do

Companies see the risk, though they do not all rank it the same. In a Kroll survey, 54% of IT and technology leaders called vendors their biggest compliance risk. Only 39.7% of the C-suite and 30.4% of risk and compliance leaders said the same. Kroll suggests the people closest to vendors understand the risk best. For owners and everyday customers, a few questions help:

• Ask which outside companies hold your customers' or patients' data.
• Ask how those vendors protect it and what happens if they are breached.
• Treat a breach notice from a company you never heard of as real. It may be a vendor.