Most people in Kroll's breach cases were hit through a third party

Breaches at technology firms reached the most people

Of the people affected through a third party, 79% were affected by a breach at a technology firm. The figures for finance, insurance and healthcare were 9%, 6% and 5%.

Technology ranked seventh for the number of organisations breached, but first for the number of people affected. Kroll says a single breach at a technology provider can expose data belonging to customers of hundreds of businesses that use it.

The figures come from Kroll's own cases and a survey

The report draws on incidents that Kroll's Cyber and Data Resilience practice handled between June 2025 and June 2026. It adds a survey of 250 risk and compliance leaders, executives and board members. So it describes Kroll's own caseload, not every breach.

In the survey, 69% of the 250 leaders said their organisation had suffered a breach in the previous 12 months. 34% reported more than one.

Kroll sells data breach notification services, including call centre and credit monitoring services.

Kroll says the supplier is often the link

Denyl Green is Kroll's global head of breach notification. He looked at most of the major incidents Kroll handled in the past year. In those, he said, a vendor, software supplier or service provider was the link to the organisations affected.

Green said one incident can reach people who have never dealt directly with the company where it began. In his view, the firms that respond best have mapped their third-party relationships and agreed a plan before an incident.

Alan Woodward wrote this month about a separate supply chain attack. He said the degree of interconnectivity, and how one part depends on another, is so often forgotten. That is his view, not a finding of the report.

For UK firms, the controller still answers for its suppliers

Under UK GDPR, a processor that suffers a breach must tell the organisation it works for without undue delay. In the ICO's example, an IT firm tells its client, and the client tells the ICO if the breach is reportable.

The organisation must report a reportable breach to the ICO within 72 hours of becoming aware of it, where feasible. If the risk to people is high, it must also tell them without undue delay.

The ICO says breach reporting should be set out in the contract with the processor, as Article 28 requires. A controller is primarily responsible for its own compliance and for its processors' compliance, and should check that compliance on an ongoing basis.

The NCSC says very few UK businesses set minimum security standards for their suppliers, according to the 2025 Security Breaches Survey. Its supply chain guidance sets out 12 principles for control and oversight.

On 10 October 2026, The Assurance Desk asked 3 Google AI services 'we've had a data breach who do we call'. 2 of the 3 answers cited at least one official source.

What happens next

Green said Kroll expects AI to feature more in next year's report. He sees it both as a tool for attackers and as a source of exposure for businesses that adopt it.

The ICO says its guidance on controllers and processors is under review, because of changes made by the Data (Use and Access) Act.