Emerging ThreatsData Breaches

Tech Firms Targeted in Most Third-Party Data Breaches

Analyst 207||Source: InfoSecMag
Modern office space with tech logo and computer workstation.

"Across most of the major incidents we handled over the past year, a vendor, software supplier or service provider was the link between the initial breach and the organizations affected. One incident can reach businesses and individuals who have never dealt directly with the company where the compromise began," Denyl Green, global head of breach notification at Kroll, said.

Third-party breaches: 69% of victims in the past year

Kroll's report, published on October 22, found that 69% of data breach victims over the prior 12 months were affected through a third-party breach. The firm surveyed security leaders and combined incident data covering the period June 2025 to June 2026 to arrive at that figure. Among security leaders surveyed, 69% said their organization had suffered a breach in the previous 12 months, and 34% reported experiencing more than one breach during that period.

Technology companies drove the lion's share of exposed individuals

Of victims caught up in third-party incidents, 79% had their data accessed following the compromise of a technology company in the June 2025–June 2026 window. Even when looking at total victims — whether from a single organization or as part of a supply chain event — incidents affecting technology firms accounted for 60% of the total number of data breach victims across the same 12 months. By comparison, the report lists insurance at 10% of victims, finance at 8%, healthcare at 8%, and education at 7.5%.

Which sectors are most often breached: finance and professional services

That prominence of technology as a source of exposed individuals contrasts with where breaches are most frequently observed. Kroll found that technology accounted for only 6% of breach incidents, making it the seventh most commonly breached sector. The sectors with the largest shares of observed breaches were finance (20%) and professional services (20%), followed by healthcare (15%) and retail (8%). Kroll's researchers highlight this discrepancy as evidence that a breach in one sector — notably technology — can cascade far beyond the initial victim.

Threat actors: Scattered Spider and the October 2026 ConnectWise access

The report calls out attacker behavior that prioritizes IT service providers and software suppliers as high-value targets. It notes cybercriminal actors such as the Scattered Spider hacking collective are known to target IT service providers to gain access to their customers' systems. Separately, the report references an October 2026 reporting that a Chinese nation-state actor gained access to IT management software provider ConnectWise’s cloud infrastructure, an access that enabled the group to target downstream customers.

What this means for technology firms, security leaders, and downstream customers

  • Technology firms and IT service providers: The data places these organizations at the center of the most consequential exposure. With 79% of third-party victims tied to tech compromises and technology-driven incidents causing 60% of total victims, vendors and software suppliers face the prospect that a single compromise may affect many downstream entities and individuals.
  • Security leaders and enterprises: Nearly seven in ten security leaders reported a breach in the prior year, and one-third experienced multiple breaches. Those leaders will likely need to reconcile high incident frequency in sectors such as finance and professional services with the outsized downstream impact when a technology provider is hit.
  • Downstream customers and individuals: The report's findings underscore Denyl Green’s point that businesses and individuals can suffer exposure without ever having dealt directly with the company where the compromise began. For affected customers, the scale of exposure is driven more by the role of the breached vendor in other organizations' operations than by the vendor's own incident count.

Kroll’s numbers sketch a stark separation between where breaches occur and where personal data is exposed. Technology firms may be a minority of breach incidents but are responsible for the majority of downstream victims; finance and professional services register the most incidents but generate far fewer cascade victims. The October 2026 reporting about ConnectWise provides a recent, concrete instance that mirrors Kroll’s broader findings: compromises of IT infrastructure can ripple through customer networks. The question the data leaves open is whether organizational practices — from procurement and vendor oversight to incident notification and recovery — will change in response to that asymmetry.

https://www.infosecurity-magazine.com/news/tech-third-party-breach-victims/

Breach NotificationData BreachEmerging ThreatsSupply ChainVendor RiskThird-Party BreachesKroll
Related Intelligence

Continue Reading

A laptop sits on a cluttered office desk with a blurred screen and a pushed-back chair, near a window.

Microsoft 365 Accounts Targeted in Widespread Token-Spraying Attacks

Cyber attackers have launched a massive assault on Microsoft 365 accounts, unleashing over 200,000 automated login attempts worldwide between July and September 2026, with a staggering 497 successful breaches. Using clever tricks like fake sign-in pages and social engineering, hackers stole valuable session tokens to gain unauthorized access.

Analyst 207
Dimly lit server room with rows of computer servers and a single unoccupied workstation.

Mirai Botnet Targets PHP2Shell Flaws in Mass Exploitation Push

Massive exploitation efforts are underway targeting PHP2Shell flaws, two high-severity vulnerabilities that allow hackers to remotely execute malicious code on vulnerable systems. Security teams must act fast to patch these flaws, which affect PHP versions as far back as 5.4, released in 2012.

Analyst 207
Linux server room with equipment racks and nodes under ordinary lighting.

Node.js Flaw Exploited via Crafted Brotli Data

Security researchers at Imperva have discovered a vulnerability in Node.js, dubbed Node2Shell, which allows attackers to run malicious code by feeding crafted Brotli data to the runtime's decoder, putting systems at risk. This flaw, tracked as CVE-2026-111497, was successfully exploited on a standard Node.js image, but has since been patched in version 24.22.1.

Analyst 207
Laptop lies open on a low table in a modern office lobby with blurred people in the background.

OAuth Attacks Expose Growing Threat to Enterprise Security

OAuth attacks have become a prime target for adversaries, who can bypass multi-factor authentication and survive password resets by stealing access and refresh tokens, granting them durable access to sensitive data. This shift in attack strategy highlights a growing threat to enterprise security, as tokens are often configured to be long-lived and provide persistent access.

Analyst 207