# Most people in Kroll's breach cases were hit through a third party

A breach at one supplier can reach the customers of many firms, so the contract and the plan matter before anything goes wrong.

The Assurance Desk, news. Published 23 October 2026.

Kroll published its yearly data breach findings on 22 October 2026. Of the incidents it handled between June 2025 and June 2026, 69% of affected individuals were affected by a third-party breach ([prnewswire.com, 7 out of 10 Individuals Hit by Data Breaches Via Third Party, Kroll Finds](https://www.prnewswire.com/news-releases/7-out-of-10-individuals-hit-by-data-breaches-via-third-party-kroll-finds-302916295.html), checked 23 October 2026).

## Breaches at technology firms reached the most people

Of the people affected through a third party, 79% were affected by a breach at a technology firm. The figures for finance, insurance and healthcare were 9%, 6% and 5% ([prnewswire.com, 7 out of 10 Individuals Hit by Data Breaches Via Third Party, Kroll Finds](https://www.prnewswire.com/news-releases/7-out-of-10-individuals-hit-by-data-breaches-via-third-party-kroll-finds-302916295.html), checked 23 October 2026).

Technology ranked seventh for the number of organisations breached, but first for the number of people affected. Kroll says a single breach at a technology provider can expose data belonging to customers of hundreds of businesses that use it ([prnewswire.com, 7 out of 10 Individuals Hit by Data Breaches Via Third Party, Kroll Finds](https://www.prnewswire.com/news-releases/7-out-of-10-individuals-hit-by-data-breaches-via-third-party-kroll-finds-302916295.html), checked 23 October 2026).

**Where third-party breaches started, by the breached firm's sector**

- Technology: 79%
- Finance: 9%
- Insurance: 6%
- Healthcare: 5%

Share of the people affected through a third-party breach, in incidents Kroll handled between June 2025 and June 2026. These are Kroll's own cases, not the whole market.

Source: prnewswire.com, 7 out of 10 Individuals Hit by Data Breaches Via Third Party, Kroll Finds, https://www.prnewswire.com/news-releases/7-out-of-10-individuals-hit-by-data-breaches-via-third-party-kroll-finds-302916295.html (checked 23 October 2026)

## The figures come from Kroll's own cases and a survey

The report draws on incidents that Kroll's Cyber and Data Resilience practice handled between June 2025 and June 2026. It adds a survey of 250 risk and compliance leaders, executives and board members. So it describes Kroll's own caseload, not every breach ([prnewswire.com, 7 out of 10 Individuals Hit by Data Breaches Via Third Party, Kroll Finds](https://www.prnewswire.com/news-releases/7-out-of-10-individuals-hit-by-data-breaches-via-third-party-kroll-finds-302916295.html), checked 23 October 2026).

In the survey, 69% of the 250 leaders said their organisation had suffered a breach in the previous 12 months. 34% reported more than one ([prnewswire.com, 7 out of 10 Individuals Hit by Data Breaches Via Third Party, Kroll Finds](https://www.prnewswire.com/news-releases/7-out-of-10-individuals-hit-by-data-breaches-via-third-party-kroll-finds-302916295.html), checked 23 October 2026).

Kroll sells data breach notification services, including call centre and credit monitoring services ([prnewswire.com, 7 out of 10 Individuals Hit by Data Breaches Via Third Party, Kroll Finds](https://www.prnewswire.com/news-releases/7-out-of-10-individuals-hit-by-data-breaches-via-third-party-kroll-finds-302916295.html), checked 23 October 2026).

## Kroll says the supplier is often the link

Denyl Green is Kroll's global head of breach notification. He looked at most of the major incidents Kroll handled in the past year. In those, he said, a vendor, software supplier or service provider was the link to the organisations affected ([prnewswire.com, 7 out of 10 Individuals Hit by Data Breaches Via Third Party, Kroll Finds](https://www.prnewswire.com/news-releases/7-out-of-10-individuals-hit-by-data-breaches-via-third-party-kroll-finds-302916295.html), checked 23 October 2026).

Green said one incident can reach people who have never dealt directly with the company where it began. In his view, the firms that respond best have mapped their third-party relationships and agreed a plan before an incident ([prnewswire.com, 7 out of 10 Individuals Hit by Data Breaches Via Third Party, Kroll Finds](https://www.prnewswire.com/news-releases/7-out-of-10-individuals-hit-by-data-breaches-via-third-party-kroll-finds-302916295.html), checked 23 October 2026).

Alan Woodward wrote this month about a separate supply chain attack. He said the degree of interconnectivity, and how one part depends on another, is so often forgotten. That is his view, not a finding of the report ([Alan Woodward on LinkedIn](https://www.linkedin.com/posts/woodwardalan_trust-center-advisories-connectwise-activity-7517501011620442112-uTp-), checked 23 October 2026).

> "the degree of interconnectivity and how one component depends on another is so often forgotten."
> Alan Woodward, LinkedIn post excerpt
> Alan Woodward on LinkedIn, M365 Supply Chain Attack Exposed, Alan W. posted on the topic, https://www.linkedin.com/posts/woodwardalan_trust-center-advisories-connectwise-activity-7517501011620442112-uTp- (checked 23 October 2026)
> [View LinkedIn post](https://www.linkedin.com/posts/woodwardalan_trust-center-advisories-connectwise-activity-7517501011620442112-uTp-)

## For UK firms, the controller still answers for its suppliers

Under UK GDPR, a processor that suffers a breach must tell the organisation it works for without undue delay. In the ICO's example, an IT firm tells its client, and the client tells the ICO if the breach is reportable ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 23 October 2026).

The organisation must report a reportable breach to the ICO within 72 hours of becoming aware of it, where feasible. If the risk to people is high, it must also tell them without undue delay ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 23 October 2026).

The ICO says breach reporting should be set out in the contract with the processor, as Article 28 requires. A controller is primarily responsible for its own compliance and for its processors' compliance, and should check that compliance on an ongoing basis ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/) and [ICO, What responsibilities and liabilities do controllers have when using a processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/responsibilities-and-liabilities-for-controllers-using-a-processor/), checked 23 October 2026).

The NCSC says very few UK businesses set minimum security standards for their suppliers, according to the 2025 Security Breaches Survey. Its supply chain guidance sets out 12 principles for control and oversight ([NCSC, Supply chain security guidance](https://www.ncsc.gov.uk/collection/supply-chain-security), checked 23 October 2026).

On 10 October 2026, The Assurance Desk asked 3 Google AI services 'we've had a data breach who do we call'. 2 of the 3 answers cited at least one official source ([The Assurance Desk: AI answers on data protection on 10 October 2026, measured 10 October 2026 (data file)](https://theassurancedesk.com/data/ai-answers-2026-10-10-data-protection.json), checked 23 October 2026).

## What happens next

Green said Kroll expects AI to feature more in next year's report. He sees it both as a tool for attackers and as a source of exposure for businesses that adopt it ([prnewswire.com, 7 out of 10 Individuals Hit by Data Breaches Via Third Party, Kroll Finds](https://www.prnewswire.com/news-releases/7-out-of-10-individuals-hit-by-data-breaches-via-third-party-kroll-finds-302916295.html), checked 23 October 2026).

The ICO says its guidance on controllers and processors is under review, because of changes made by the Data (Use and Access) Act ([ICO, What responsibilities and liabilities do controllers have when using a processor?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/responsibilities-and-liabilities-for-controllers-using-a-processor/), checked 23 October 2026).

## Explore the data

Download the dataset or open the cited links in a spreadsheet.

- [Dataset (JSON)](https://theassurancedesk.com/data/ai-answers-2026-10-10-data-protection.json)
- [Cited links (CSV)](https://theassurancedesk.com/data/ai-answers-2026-10-10-data-protection.csv)

## Read next

- [Data protection: the section](https://theassurancedesk.com/data-protection)
- [What is supplier assurance, and what do buyers check?](https://theassurancedesk.com/guides/supplier-assurance-what-buyers-check)
- [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report)
- [Data processing agreement: what must an Article 28 contract say?](https://theassurancedesk.com/guides/article-28-processor-contract)
- [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call)
- [After a breach or ICO contact](https://theassurancedesk.com/best/post-breach)

## Sources

- prnewswire.com, 7 out of 10 Individuals Hit by Data Breaches Via Third Party, Kroll Finds: https://www.prnewswire.com/news-releases/7-out-of-10-individuals-hit-by-data-breaches-via-third-party-kroll-finds-302916295.html (checked 23 October 2026)
- Alan Woodward on LinkedIn: https://www.linkedin.com/posts/woodwardalan_trust-center-advisories-connectwise-activity-7517501011620442112-uTp- (checked 23 October 2026)
- ICO, Personal data breaches: a guide: https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 23 October 2026)
- ICO, What responsibilities and liabilities do controllers have when using a processor?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/responsibilities-and-liabilities-for-controllers-using-a-processor/ (checked 23 October 2026)
- NCSC, Supply chain security guidance: https://www.ncsc.gov.uk/collection/supply-chain-security (checked 23 October 2026)
- The Assurance Desk: AI answers on data protection on 10 October 2026, measured 10 October 2026 (data file): https://theassurancedesk.com/data/ai-answers-2026-10-10-data-protection.json (checked 23 October 2026)

This is an independent editorial guide, not legal advice.

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.