7 out of 10 individuals hit by data breaches via third party, Kroll finds
Kroll, the leading independent provider of financial and risk advisory solutions, today revealed that two-thirds of organizations surveyed (69%) suffered a data breach in the past year. More than a third (34%) were breached more than once, according to its 2026 annual Data Breach Outlook.
Further analysis showed that financial services accounted for the largest share of organizations breached in Kroll’s cases, at 20%, but a single breach at a technology provider can expose data belonging to customers of hundreds of businesses that use its services.
Of the incidents handled by Kroll in the twelve months between June 2025 and June 2026, 69% of affected individuals were impacted by a third-party breach. 79% of those individuals were affected by a breach from the technology sector, which is significantly higher compared to the finance (9%), insurance (6%) or healthcare (5%) sectors.
Breaches at technology firms accounted for the largest number of affected individuals, followed by insurers, despite ranking seventh and ninth respectively for the total number of organizations breached.
Data and Trends from the Kroll Data Breach Outlook 2026
- Repeated breaches are common. Of the 250 leaders surveyed by Kroll, 69% said their organization had suffered a breach in the previous 12 months, while 34% reported experiencing more than one.
- IT teams are far more concerned about third parties than senior leaders. More than half (54%) of IT and technology leaders identified vendor and third-party breaches as their biggest compliance risk, compared with 40% of C-suite executives and 30% of risk and compliance leaders.
- Third-party relationships complicate the response. Dependence on vendors was among the top four challenges leaders faced when making breach-response decisions, cited by 41% of respondents.
- A small number of breaches can have a wide impact. Technology ranked seventh for the number of organizations breached but first for the total number of individuals affected. Insurance ranked ninth for the number of organizations breached but second for the total number of individuals affected.
Denyl Green, global head of breach notification at Kroll says, “Kroll handles thousands of incidents every year. Across most of the major incidents we handled over the past year, a vendor, software supplier or service provider was the link between the initial breach and the organizations affected. One incident can reach businesses and individuals who have never dealt directly with the company where the compromise began.”
“As AI agents are given more access to systems and sensitive data, breach risk rises across both human on non-human identities. Data and identity governance are becoming even more complex, and we expect AI to feature more prominently in Kroll’s Data Breach Outlook next year, both as a tool used by attackers and as a source of exposure for businesses adopting it.”
“When a supplier is breached, every client needs to determine whose data was affected and whether customers and regulators need to be notified. The businesses that respond most effectively have already mapped their third-party relationships and the subsequent domino effect, with an agreed plan in place before an incident happens. That preparation can reduce both the complexity and the cost of managing a breach, as well as give greater peace of mind.”
Katherine Keefe, Global Cyber Insurance Industry lead at Kroll says, “Kroll’s breach data shows a single supplier breach can trigger dozens or even hundreds of cyber insurance claims from businesses whose only connection is that they use the same provider. These scenarios exponentially increase potential cyber insurance losses compared to breaches affecting a single business.”
“Cyber underwriters are already responding, not only by more closely scrutinizing how businesses manage their suppliers, but also by identifying potential single points of failure which may be caused by vendors and suppliers serving wide swaths of industry. Cyber insurance claims teams managing aggregated losses are also impacted and require efficient incident response and breach notification best practices when multiple policyholders are affected by the same event.”
“Cyber insurers now know that identifying dependencies on common vendors is critical to assessing and minimizing the risk that one breach will impact many policyholders.”