1. Executive summary
Kroll's Data Breach Outlook 2026 reports that nearly seven in ten individuals affected by data breaches Kroll handled over the past year were exposed through an outside supplier rather than the breached organisation itself. Technology providers accounted for 6% of breach cases but 60% of affected individuals, and Kroll states that a single supplier breach can generate dozens or hundreds of cyber insurance claims from businesses whose only common link is shared use of that provider. The report is a trend and market piece built on Kroll's own caseload; it names no actor, no CVE and no specific victim, and no CVE, CVSS score or CISA KEV state is associated with it. For EMEA financial services the exposure is concentration and notification risk: a compromise at a shared processing, records or software provider can put client data in scope of DORA third-party and incident-reporting duties without the firm being the point of compromise.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28 | Kroll reports that 70% of affected individuals were exposed via an outside supplier, and that technology providers account for 60% of affected individuals, so a firm's ICT third-party estate is the dominant path to its clients' data | Third-party risk management must treat shared providers as the primary exposure path, not a residual one; contractual and monitoring controls over those providers carry the bulk of the resilience obligation |
| DORA Art. 29 | Kroll states that a single supplier breach can trigger dozens or hundreds of claims from businesses whose only connection is shared use of the provider, which is the concentration-risk condition | Firms need a preliminary assessment of ICT concentration risk that identifies providers whose failure would hit multiple parts of the business at once, not a per-contract review |
| DORA Art. 30 | The report describes data belonging to one organisation, held by another and compromised at a subcontractor, which is the sub-outsourcing chain the contractual provisions govern | Contracts must address sub-outsourcing and the evidence a provider will supply to a client after a breach, because Kroll notes exposure decisions depend on evidence from the compromised provider |
3. Technical analysis & attack chain
This item is a market and trend report, not a technical incident. Kroll gives no exploited component, no malware, no command-and-control and no atomic indicators. The mechanism it describes is structural: a provider that stores records, processes transactions or operates software for many clients becomes the single point through which one compromise reaches many organisations and individuals, some of whom have never dealt with the provider directly. Subcontracting extends the chain when a supplier uses another company to store or process its clients' data.
The one worked example in the report is the MOVEit file-transfer attacks, cited to show that organisations were exposed both through their own use of the software and through vendors that used it to handle their information. Kroll gives no MOVEit version, CVE or exploitation detail, so none is reproduced here.
The operational consequence Kroll describes is investigative, not technical. After a supplier breach each client must establish whether its records were involved, which details were exposed and who must be notified, and those decisions may depend on evidence held by the compromised provider. Around four in ten respondents cited vendor dependencies as a challenge in breach-response decisions. On the insurance side, Katherine Keefe, Kroll's Global Cyber Insurance Industry Lead, states that underwriters are examining how businesses manage suppliers and identifying providers whose services could create a single point of failure across many organisations.
Confidence caveat: every figure and quotation here is single-sourced to Kroll's Data Breach Outlook 2026 as reported by Help Net Security. The percentages are drawn from Kroll's own breach-notification caseload and are not independently corroborated; treat them as directional. No named threat actor is involved, so no MITRE ATT&CK attribution applies.
4. Mitigation & containment
P1 (within 24h)
- Build a list of the providers that hold, process or operate software touching client records, transactions or regulated data, and mark any provider used by more than one business unit or legal entity. Kroll's concentration finding is the reason this ranks first: the loss is shared, so the inventory has to be firm-wide, not per-contract.
- For each provider on that list, confirm in writing whether it sub-outsources storage or processing and to whom. The report's subcontractor chain is the gap most firms cannot currently answer.
P2 (within 72h)
- Add a contractual clause requiring the provider to supply, within a defined window of a breach, the specific evidence a client needs: whether that client's records were involved, which fields were exposed, and the notification population. Kroll notes exposure decisions depend on evidence from the compromised provider, so the right to that evidence must be agreed before an incident.
- Write the notification template for the case where the breached provider is one the customer has never heard of. The report states notifications must explain how an unfamiliar supplier obtained the information, what was exposed and what action to take.
P3 (within 7 days)
- Run a tabletop in which a shared records or transaction provider is compromised and the firm must decide notification scope from incomplete provider evidence. Around four in ten respondents in the report cited vendor dependencies as the blocking challenge; the exercise should surface where the firm's own decisions stall.
- Feed the concentration list into the DORA Art. 29 preliminary assessment and into insurance disclosure, since Kroll states underwriters are now assessing exactly this dependency.
5. Indicators of compromise
No indicators of compromise available in the source material. The report describes no malware, infrastructure or atomic artefacts, and the MOVEit reference carries no technical detail.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- Help Net Security, "Breach victims discover their data was held by companies they've never heard of", https://www.helpnetsecurity.com/2026/10/28/kroll-third-party-data-breaches-insurance-claims-report/, 2026-10-28. Reports Kroll's Data Breach Outlook 2026; single source for all figures and quotations in this advisory.
8. Adverse Trace position
Adverse Trace assesses this as a strategic item with no technical severity to assign: there is no CVE, no CVSS score and no CISA KEV entry, and the report names no actor. The risk it describes is real for EMEA financial services because the third-party path it quantifies is the same path DORA Art. 28 to 30 already regulate, and the figures are single-sourced to Kroll's own caseload, so we treat them as directional rather than measured. Client impact is concentration and notification exposure: a shared provider compromise can put a firm's client data at risk and leave the firm dependent on that provider's evidence to decide who to notify. We will track Kroll's full Data Breach Outlook 2026 when published and cross-check its sector breakdown against our own third-party incident monitoring, and we will flag any named provider or incident that turns the trend into a specific exposure.
Published via PulseTrace — Adverse Trace threat intelligence.