The digital ecosystem is currently facing a stark reality: the strength of an organization’s security posture is no longer defined solely by its own defenses, but by the vulnerabilities inherent in its partners and vendors. A comprehensive new report released by Kroll, the global financial and risk advisory firm, has illuminated a troubling trend in the cybersecurity landscape. According to the research, more than two-thirds (69%) of individuals affected by data breaches over the past year were caught in the crossfire of third-party compromises. This statistic serves as a sobering reminder that for the modern enterprise, the perimeter has effectively dissolved, replaced by a complex, interconnected web of supply chain dependencies.
The Kroll report, which analyzed breach data from June 2025 to June 2026, highlights a specific, high-risk focal point: the technology sector. Of the individuals impacted by these third-party incidents, a staggering 79% had their personal data accessed following a breach at a technology company. This figure vastly outweighs the impact of breaches originating in other critical sectors. By comparison, third-party incidents stemming from the financial sector accounted for 9% of victims, followed by the insurance industry at 6%, and the healthcare sector at 5%.
The data suggests that when a technology provider is compromised, the downstream impact is not merely additive; it is exponential. When examining the total number of data breach victims over the 12-month period—encompassing both single-organization incidents and broader supply chain attacks—technology firms were responsible for 60% of all affected individuals. This concentration of impact underscores the systemic risk posed by IT service providers, cloud infrastructure companies, and software vendors that serve as the backbone for thousands of other businesses across the global economy.
The Paradox of Breach Frequency vs. Impact
Perhaps the most counterintuitive finding in the Kroll report is the disparity between which sectors are most frequently targeted and which sectors cause the most widespread damage. While technology firms are the primary drivers of individual victim counts, they are not, ironically, the most frequently breached sector.
The research indicates that the financial and professional services sectors are the most common targets for cybercriminals. Finance accounted for 20% of all observed breaches, matching the 20% share held by professional services. Healthcare followed at 15%, with the retail sector accounting for 8%. In contrast, the technology sector represented only 6% of the total number of breach incidents recorded by Kroll.
This data reveals a critical "domino effect" in modern cyber threats. While a cybercriminal might find it more lucrative or accessible to target a financial firm or a healthcare provider directly, a breach within the technology sector—a single software provider or a cloud management platform—can serve as a force multiplier. By compromising one technology vendor, an attacker gains a foothold into the systems of hundreds or thousands of that vendor’s clients, effectively bypassing the individual defenses of those organizations.
The scope of this issue is reflected in the survey responses from security leaders included in the Kroll report, which was published on October 22. When asked about their own organizations’ experiences, 69% of security leaders confirmed that they had suffered at least one breach in the previous 12 months. Perhaps more concerning is that 34% reported experiencing multiple breaches within that same timeframe. These numbers suggest that the threat landscape has reached a point of saturation, where security teams are perpetually managing the fallout from both direct and indirect intrusions.
The Anatomy of the Supply Chain Domino Effect
The researchers at Kroll noted that the discrepancy between the frequency of breaches and the number of victims highlights a fundamental shift in how organizations must assess risk. For years, cybersecurity strategy focused heavily on protecting the internal assets of the organization. However, the current environment necessitates a much broader focus on the entire digital supply chain.
Denyl Green, the global head of breach notification at Kroll, emphasized the interconnected nature of these risks. "Across most of the major incidents we handled over the past year, a vendor, software supplier or service provider was the link between the initial breach and the organizations affected," Green noted. "One incident can reach businesses and individuals who have never dealt directly with the company where the compromise began."
This "indirect" nature of the modern breach presents a significant challenge for incident response and legal liability. When a breach occurs through a third party, the affected organization often finds itself in a position where it must manage the reputation and regulatory consequences of a compromise that originated outside of its own controlled infrastructure. The trust that consumers place in a service provider is often extended to that provider’s entire ecosystem, meaning a failure at the vendor level is frequently perceived by the public as a failure of the primary brand.
The tactics employed by sophisticated threat actors are evolving to exploit this exact vulnerability. Criminal collectives have become increasingly adept at identifying the "weakest link" in a supply chain. For example, the hacking group known as Scattered Spider has frequently targeted IT service providers, recognizing that by compromising these entities, they can gain lateral movement into the systems of high-value downstream customers.
This is not a theoretical threat, but a persistent operational reality. In October 2026, the industry observed a high-profile example of this strategy when it was reported that a Chinese nation-state actor successfully gained access to the cloud infrastructure of ConnectWise, a prominent provider of IT management software. By infiltrating the provider’s systems, the threat actors were able to gain a foothold that could potentially be used to target the downstream customers who rely on ConnectWise’s tools to manage their own IT environments. Such incidents demonstrate that the "trusted" software used to manage security and operations can, if compromised, become the primary vector for widespread infiltration.
As organizations continue to outsource critical functions to third-party vendors, the reliance on external technology providers is only expected to grow. The Kroll report serves as a stark warning to boards and executive leadership teams that the traditional methods of vendor risk management—which often rely on static, annual questionnaires—are insufficient for the current threat landscape. Instead, the findings advocate for a more proactive, continuous monitoring approach to third-party risk.
The data confirms that the cybersecurity of the future is not a siloed endeavor. It is a shared responsibility that spans the entire supply chain. As technology firms become the central nodes of global business operations, their security becomes the security of their customers. The 69% of victims affected by third-party breaches stand as a testament to the fact that, in a hyper-connected world, an organization is truly only as secure as its most vulnerable vendor. With tech firms responsible for such a disproportionate share of the impact, the burden of defense must shift toward securing the foundational software and services that keep the modern digital economy running.
