SUPPLY CHAIN SECURITY | INCIDENT RESPONSE

July 10, 202611 min read

Your Vendor Just Announced a Breach: The 24-Hour Customer Response Checklist

Sources:Verizon 2025 DBIR: Third-Party Breach Trends|IBM Cost of a Data Breach 2025|Identity Theft Resource Center 2025 Business Aftermath Report

Eric Bang

Founder & Cybersecurity Evangelist

15%

of breaches in the 2025 Verizon DBIR involved a third-party component — up from 9% the year prior, showing accelerating supply chain risk

$4.88M

average cost of a data breach in 2025 — IBM report; breaches involving third-party credentials or access cost 9.5% more than average

72 hours

GDPR notification window that vendors in the EU are required to notify affected customers — but many notifications are delayed or information-sparse

196 days

average time to identify a breach in 2025 — IBM; customers often learn about vendor breaches before the vendor has completed their own investigation

Hours 0-4: Immediate access triage

The first priority is auditing and revoking the access your organization gave the vendor — regardless of what data the vendor says was compromised. Vendor breach notifications are often conservative in their initial scope assessments.

Identify all access the vendor had to your environment

Answer these questions before doing anything else: Does the vendor have API keys or OAuth tokens with access to your systems? Does the vendor have user accounts or service accounts in your identity provider? Do any vendor support users have privileged access to your cloud infrastructure, ticketing system, or data stores? Do vendor agents have VPN access to your internal network? Does the vendor hold stored credentials for any of your systems for integration purposes? Every yes answer is an access vector that must be audited.

Rotate API credentials issued to the vendor immediately

If you issued API keys to the vendor for their integration, rotate them immediately regardless of whether the vendor's notification specifically mentions API credential exposure. If the vendor's authentication database was compromised, keys stored there may be in attacker hands. Generate new keys, update any automation that uses the vendor integration on your side, and disable the old keys. This takes 30 minutes and removes a confirmed risk vector.

Suspend or audit vendor user accounts in your IdP

If vendor personnel have accounts in your Okta, Entra ID, or any other system, temporarily suspend those accounts until the vendor can confirm which of their personnel accounts were involved in the breach. Review the last 30 days of authentication logs for those accounts for anomalous activity — geographic anomalies, access outside normal business hours, access to resources the vendor does not normally touch.

Check for active sessions from vendor IPs

Review your IdP and application authentication logs for active sessions sourced from the vendor's known IP ranges. Any session that cannot be attributed to a legitimate vendor interaction in your change log is suspicious. Terminate all active vendor-sourced sessions pending investigation.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Hours 4-12: Demand specific answers from the vendor

Vendor breach notifications are legally drafted and deliberately vague about scope in the initial notification. Your right as a customer is to demand specific answers to specific questions within a defined timeframe.

Ask: Was data specific to our organization accessed?

Vendors often issue broad notifications covering all customers when only a subset of customer data was accessed. Request confirmation: was our tenant's data, user records, or any data specific to our organization accessed or exfiltrated? Request the date range of the breach, the attack vector, and the specific data types involved. If the vendor cannot confirm or deny exposure of your specific data, treat it as confirmed exposure and respond accordingly.

Ask: Were API keys, OAuth tokens, or integration credentials compromised?

Request specific confirmation of whether any credentials your organization issued to the vendor were stored in the compromised system and whether those credentials were accessed. If the vendor cannot answer this within 24 hours, assume the answer is yes and rotate all credentials.

Ask: Were your personnel's authentication credentials for the vendor's platform exposed?

If your employees use the vendor's SaaS platform with username/password authentication, request confirmation of whether user credential data (hashed passwords, email addresses, authentication tokens) for your organization's accounts was in the compromised dataset. If yes, your employees need immediate password resets and should be notified to change any reused passwords for other services.

Ask: Was the breach a full tenant isolation failure or limited to the vendor's own infrastructure?

In multi-tenant SaaS environments, the most critical question is whether the attacker could access customer data through the vendor's internal systems (a breach of the vendor's own database) or whether there was a tenant isolation failure that allowed cross-customer data access. The former affects what the vendor stored about you; the latter potentially exposes your data and other customers' data to each other.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Free daily briefing

Briefings like this, every morning before 9am.

Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.

Hours 12-24: Assess exposure and determine escalation

With initial access triage complete and vendor answers requested, assess whether this requires escalation to a full incident response posture or can be managed as a vendor risk event.

Determine if sensitive data the vendor holds was exposed

Document what data your organization shared with or through the vendor: customer PII, employee data, financial data, source code, intellectual property, regulated data (health records, payment data). If the vendor's breach involved access to data stores containing this type of information, escalate to your DPO and legal team — you may have notification obligations to your own customers or regulators, even though the breach originated at the vendor.

Assess the blast radius of the vendor's access

If the vendor had privileged access to your environment (cloud infrastructure access, network access, privileged service accounts), conduct a forensic review of what that access could have reached if the vendor's credentials were used against your systems. Run a SIEM search for authentication events from the vendor's service accounts across your entire logging window during the breach timeframe.

Review your contract for notification and SLA obligations

Review your agreement with the vendor for: their required notification timelines (did they notify you within the contractually required window?), their incident response and cooperation obligations, their breach liability provisions, and their audit rights provisions that allow you to independently verify their security posture. Document any contractual violations for potential legal escalation.

Decide: vendor risk event versus incident response escalation

If analysis shows no evidence of actual access to your systems, limited data exposure, and rotated credentials now secure the integration, handle this as a vendor risk event: document findings, require vendor evidence of remediation, update vendor risk rating in your TPRM program. If analysis shows possible access to your environment, confirmed customer or employee data exposure, or evidence of API credential abuse, escalate to full IR: engage your incident response team, preserve logs, notify your CISO and legal team, and treat this as your own breach for response purposes.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Post-incident: Reduce future downstream exposure

Vendor breaches are recurring events. Reducing the blast radius of future vendor breaches requires structural changes to how vendor integrations are architected.

Principle of least privilege for vendor integrations

API keys and OAuth grants issued to vendors should have the minimum permissions required for their integration function — read-only where possible, scoped to specific resources rather than broad account access. Audit all current vendor integrations against this principle and reduce overly permissive grants.

Separate vendor access from your core identity provider where possible

Vendor support users should not have accounts in your primary Okta or Entra ID tenant if they do not need access to internal corporate systems. Use vendor portals' own user management, or maintain a separate tenant or organizational unit for external vendor users with tighter access restrictions.

Inventory all vendor data holdings

Maintain a data inventory that maps: which vendors hold which categories of your data, what the contractual data handling requirements are, and what data deletion or return processes exist. This inventory is required for GDPR and other privacy regulations but also directly answers the first question when a vendor announces a breach: what data did we give them and how sensitive is it?

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

The bottom line

The vendor breach notification email is not the beginning of the event — it is a late notification of something that already happened. The 24-hour customer response is about closing the access vector (rotating credentials, suspending vendor accounts, auditing sessions) before confirmation of exposure, because by the time the vendor's investigation concludes weeks later, an attacker using compromised vendor credentials will have already achieved their objective. Act on access revocation immediately; treat vendor answers as information that modifies your escalation decision, not as a prerequisite for taking protective action.

Frequently asked questions

Is my organization required to notify my own customers if a vendor breaches data they held for me?

In most regulatory frameworks (GDPR, CCPA, HIPAA, and state privacy laws), you as the data controller are responsible for notifying affected individuals when personal data is compromised — regardless of whether the breach occurred at your organization or at a third-party processor. Vendor breach of data you entrusted to them is your breach for notification purposes in most frameworks. Engage your DPO and legal counsel immediately upon confirmation that personal data was affected.

What is the difference between a vendor breach notification and a vendor security incident?

A vendor breach notification is a formal disclosure that personal data or sensitive information was accessed without authorization — triggering regulatory and contractual obligations. A vendor security incident is a broader term covering any security event at the vendor, including attempted but unsuccessful access, system outages caused by attacks, or internal security events that did not expose customer data. Vendors sometimes issue 'security incident' notifications to avoid the legal trigger of 'breach' notifications — distinguish between the two in your response process.

How should I handle a vendor who is slow to respond to my questions after their breach notification?

Document every information request with timestamp and send via email to create a paper trail. Escalate within the vendor organization to your account executive and the vendor's security or privacy team. Reference specific contractual notification and cooperation obligations if they exist. If the vendor is non-responsive on questions about your specific data exposure, consult legal counsel about your options under the contract and applicable privacy regulations. For critical integrations, assume worst-case exposure and take protective action while waiting for vendor confirmation.

Sources & references

Verizon 2025 DBIR: Third-Party Breach Trends
IBM Cost of a Data Breach 2025
Identity Theft Resource Center 2025 Business Aftermath Report

Free resources

Free download

Critical CVE Reference Card 2025–2026

25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.

Free download

Ransomware Incident Response Playbook

Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.

Free newsletter

Get threat intel before your inbox does.

50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.

Unsubscribe anytime. We never sell your data.

Author

Eric BangCISSP

Founder & Cybersecurity Evangelist, Decryption Digest

Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.

View profile →LinkedIn

Back to all briefings

Subscribe for Updates

vendor breach customer response third-party breach response supply chain incident response vendor notification breach downstream customer breach SaaS vendor breach 2026 vendor risk incident response third-party data breach response

Black Hat Giveaway

Win a $2,495 Black Hat pass.

Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.

Your Vendor Just Announced a Breach: The 24-Hour Customer Response Checklist

Hours 0-4: Immediate access triage

Hours 4-12: Demand specific answers from the vendor

Hours 12-24: Assess exposure and determine escalation

Post-incident: Reduce future downstream exposure

The bottom line

Frequently asked questions

Is my organization required to notify my own customers if a vendor breaches data they held for me?

What is the difference between a vendor breach notification and a vendor security incident?

How should I handle a vendor who is slow to respond to my questions after their breach notification?

Sources & references

Critical CVE Reference Card 2025–2026

Ransomware Incident Response Playbook

Get threat intel before your inbox does.

Subscribe to enter the giveaway