Your vendor got hacked. Now your data is on the table.

A third-party breach happens through someone you do business with: a software supplier, an agency, a payment provider, an app connected to your email or CRM. Your own defenses can be solid and you can still be hit, because the attacker walks in through the supplier's door.

Verizon's 2026 Data Breach Investigations Report, covering 1 November 2024 to 31 October 2025, puts a number on it. Its authors write that "breaches with third-party involvement have increased by 60% from last year's dataset, reaching 48% of total breaches." Verizon's measure covers several kinds of supplier relationship, not only software supply chains, so read it as a signal about reliance on suppliers in general.

Verizon also says a good number of the cloud-based third-party incidents it reviewed "boil down to" insecure authentication, such as missing multifactor sign-in or poor credential rotation, or to a lack of least privilege. The same report shows how slowly suppliers fix basics. In its data on third-party cloud exposure, only 23% of third-party organizations fully fixed missing or improperly secured multifactor authentication on their cloud accounts. For weak passwords and permission mistakes, it took almost eight months to resolve half of all findings.

The UK's National Cyber Security Centre (NCSC) makes a similar point about contracts. Its supply chain guidance says "very few UK businesses set minimum security standards for their suppliers". The guidance is written for large organizations and the public sector, but the idea scales down: decide what you expect from a vendor before it has your data.

Google Threat Intelligence Group (GTIG) published the clearest documented example, from August 2025. A sales-chat app called Drift, made by Salesloft, was connected to many companies' Salesforce accounts through OAuth tokens. A token works like a spare key: it lets an app act in your account without your password. GTIG reports that an attacker, tracked as UNC6395, stole those tokens and used them to export large amounts of data from numerous corporate Salesforce instances.

1. 8 August 2025Earliest activity GTIG saw, using the stolen Drift tokens.
2. 9 August 2025In an update, GTIG says Drift Email tokens were also used to reach a very small number of Google Workspace accounts set up to integrate with Drift.
3. 18 August 2025Latest activity GTIG saw.
4. 20 August 2025Salesloft, working with Salesforce, revoked all active Drift access and refresh tokens.
5. 27 and 28 August 2025GTIG publishes its analysis and an update.

Two details matter for a small business. First, GTIG says "this issue does not stem from a vulnerability within the core Salesforce platform". Salesforce was not the weak link. A connected app was. Second, the attacker searched the stolen data for secrets: GTIG saw it hunting for Amazon Web Services access keys, passwords and Snowflake tokens. Data stolen from one tool became a way into others.

GTIG's advice was blunt. It told Drift customers to "treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised". That is the practical lesson: when a vendor is breached, the questions are which keys it held, and how fast you can rotate them.

In October 2026, a criminal group called n0n listed 38 shipping lines, ports and terminal operators on a leak site on 12 October and set a payment deadline a week later, according to The Maritime Executive. The same reporting says none of the 38 organizations has publicly confirmed that its systems were compromised, and that security researchers say the source and extent of the data are unconfirmed. Some analysts suspect the files came from one shared system, but that is a theory, not a finding.

Whatever the truth turns out to be, the shape is familiar. Many companies in one industry, one common supplier somewhere behind them, and each victim learning of the problem from the news. That is why the checklist below starts with a list of your own suppliers.

These steps follow the NCSC's supply chain principles and the Drift lesson. They are sized for a team without a security department.

• List every vendor that touches your dataInclude apps connected to email, files, your CRM, your cloud and your payments. Mark the ones that hold customer data, money or credentials.
• Set minimum security requirementsPut short, proportionate expectations in every contract: sign-in protection, patching, encryption. Ask vendors to pass them on to their own suppliers.
• Ask for evidence, not promisesA recognized certification, a short questionnaire or a summary of a recent security test is enough for most small suppliers. Check again at renewal.
• Write down incident dutiesAgree how fast a vendor must tell you about a breach and what help you get. NIS2 asks covered EU organizations to think about this for direct suppliers.
• Cut vendor access to the minimumGive each vendor only the permissions it needs, turn on multifactor sign-in, and rotate keys and tokens on a schedule. Verizon's data links many third-party incidents to missing multifactor sign-in and slow fixes.
• Audit connected apps every quarterRemove anything unused. Know where to revoke each app's tokens, and practice it once.
• Plan for a supplier failingKnow your alternatives and keep your own backups of the data you need to keep running. CISA publishes a guide for small and medium-sized businesses on building a supply chain risk plan.
• Watch and reviewSubscribe to vendors' security notices and review the list twice a year. Incidents like Drift are announced by the vendor or researchers first, so someone should read those posts.

If you operate in the EU in a sector covered by the NIS2 directive, supplier risk is a legal duty. Article 21 lists supply chain security among the measures covered organizations must take, including the security of the relationships with direct suppliers and service providers. It also asks them to weigh each direct supplier's specific weaknesses and cybersecurity practices.

In the UK, the NCSC's supply chain guidance sets out a set of principles for understanding risks, setting controls and checking arrangements, and recommends Cyber Essentials as a baseline for suppliers. In the US, CISA publishes small-business resources for supply chain risk planning. None of these replaces advice for your own situation, but all of them point the same way: know your suppliers, set expectations, check, and be ready to react.

Related reading: six cheap habits that block the attacks small businesses actually face, and how weak links show up in other places, such as the October 2026 eMudhra certificate authority compromise.