Tech Supplier Breaches Are Driving Most Third-Party Data Breach Victims, Kroll Finds

More than two-thirds (69%) of data breach victims in the past year were affected by a third-party breach, according to a new report from financial and risk advisory provider Kroll. Of those people, 79% had their data accessed after a technology company was compromised, during the period June 2025 to June 2026. Technology firms were behind 60% of all breach victims, well ahead of insurance (10%), finance (8%), healthcare (8%) and education (7.5%).

The numbers point to a mismatch between how often a sector is breached and how far the damage spreads. Technology made up only 6% of breach incidents Kroll observed, making it the seventh most commonly breached sector. Finance and professional services each accounted for 20%, followed by healthcare (15%) and retail (8%). Researchers said a breach at a technology company can have a much wider domino effect. Among security leaders surveyed, 69% said their organisation had suffered a breach in the previous 12 months, and 34% reported more than one.

Denyl Green, Kroll's global head of breach notification, said a vendor, software supplier or service provider was the link between the initial breach and the affected organisations in most major incidents. One incident can reach businesses and individuals who never dealt directly with the company where the compromise began. The article notes that groups such as Scattered Spider are known to target IT service providers to reach their customers' systems, and that a Chinese nation-state actor was reported to have accessed ConnectWise's cloud infrastructure, enabling it to target downstream customers.