Understanding the Disparity
Between June 2025 and June 2026, technology companies accounted for 60% of all data breach victims, despite representing only 6% of breach incidents. This highlights a critical vulnerability in how your team approaches third-party risk: the sectors breached most often aren't necessarily the ones that will hurt you the most.
Finance led breach frequency at 20% of incidents, followed by professional services (20%) and healthcare (15%). Yet, when measuring victim impact, technology firms dominated. Of the 69% of breach victims affected by third-party incidents, 79% had their data compromised through a technology company breach.
The takeaway is clear: when a tech vendor is breached, the impact extends far beyond the initial target.
Attack Patterns and Consequences
The Kroll report documented a 12-month period where 69% of surveyed security leaders experienced at least one breach, with 34% reporting multiple incidents. The technology sector's significant impact stems from its position in the supply chain. IT service providers, cloud infrastructure platforms, and software vendors are upstream of hundreds or thousands of downstream customers.
ConnectWise exemplifies this cascade effect. In October 2026, a nation-state actor compromised the company's cloud infrastructure, creating access pathways to downstream customers. The breach wasn't about ConnectWise's data; it was about using ConnectWise as a bridge.
Threat actors like Scattered Spider have adopted this strategy, deliberately targeting IT service providers to multiply their access.
Identifying Control Failures
Your organization may not fail at perimeter defense, but at supply chain architecture and criticality classification.
Inadequate vendor segmentation. Many organizations treat technology vendors as a single category rather than mapping their actual data flows and access privileges. A cloud backup provider has different blast radius potential than a marketing automation tool, yet both often sit in the same risk tier.
Missing fourth-party visibility. When you contract with a managed service provider, you're inheriting their vendor relationships. The ConnectWise incident demonstrates this: customers didn't just trust ConnectWise's security posture; they unknowingly trusted everyone ConnectWise granted infrastructure access to.
No concentration risk assessment. Consolidating multiple functions under single technology providers creates single points of failure. One breach can expose multiple vectors.
Lack of substitutability planning. Few organizations maintain viable alternatives for critical technology vendors. When a breach occurs, you're locked in during the most dangerous window.
Standards and Compliance
SR 23-4 (section III.B.1) requires you to "identify, assess, and document the risks that third parties may pose" with particular attention to "the nature and criticality of the activity." A technology vendor handling authentication, data storage, or network access meets any reasonable definition of critical activity, yet many organizations still classify them as moderate risk based on contract value rather than systemic impact.
ISO 27036-3 (clause 7.1.2) mandates that you "determine information security risks associated with supplier relationships," including "the potential impact of a security incident involving the supplier." The 79% figure from the Kroll report makes this concrete: if your tech vendor is breached, assume your data is in scope.
EBA Outsourcing Guidelines (Article 5) require institutions to "identify and assess all relevant risks" arising from outsourcing arrangements, including "the risks of disruption to the provision of services." The ConnectWise incident shows how infrastructure compromise creates exactly this disruption risk.
The standards aren't asking you to predict which vendors will be breached. They're asking you to assume breach and design accordingly.
Actionable Steps
Reclassify your technology vendors immediately. Don't wait for the next assessment cycle. Any vendor with direct access to production systems, authentication infrastructure, or sensitive data repositories should move to your highest criticality tier. This triggers enhanced due diligence, continuous monitoring, and stricter contractual controls.
Map your fourth-party technology exposure. Your MSP's cloud provider is your risk. Your SaaS platform's authentication service is your risk. Require sub-processor disclosure for all critical technology arrangements. ISO 27036-2 (clause 8.2) supports this: you need visibility into "the supplier's supply chain" where it affects your information security.
Implement concentration limits for technology functions. If one vendor handles your email, backup, and identity management, you've created a single breach scenario that compromises three Critical or Important Functions. Distribute these capabilities across providers with isolated access boundaries.
Build substitutability into technology contracts. Your right to audit (which you should have) means nothing if you can't leave. Require data portability provisions, maintain current architecture documentation, and test failover procedures. The EBA Guidelines (Article 12) specifically require "exit strategies" for critical or important functions.
Establish notification timelines tied to downstream impact. Your technology vendor should notify you of a breach within 24 hours if the incident involves systems with access to your environment. Don't accept generic 72-hour windows. The standard vendor breach management timeline assumes you're one victim among many; you need to know immediately if you're potentially exposed.
Monitor for fourth-party incidents. When ConnectWise was breached, their customers needed to act even if ConnectWise's security team hadn't completed their assessment. Subscribe to threat intelligence feeds that track your vendors' vendors. Scattered Spider and similar groups announce their targets; you should know before your vendor's notification arrives.
The 6% versus 60% disparity isn't a statistical anomaly. It's a structural warning: your riskiest vendors aren't the ones getting breached most often. They're the ones that, when breached, take you down with them.
