Third-Party and Vendor Data Breach Statistics

The share went from 15% to 30% to 48% in three editions. That last step is a 60% relative increase, not a 60-point jump, but the direction is hard to miss.

Retail at 68% and manufacturing at 61% had the highest third-party shares. Small and medium-sized businesses came in at 55%, above the overall figure of 48%.

Northern America had the lowest third-party share at 43%, while Latin America and the Caribbean reached 74%. Lower here still means a vendor was involved in a large share of breaches.

SecurityScorecard found retail and hospitality highest at 52.4%. Healthcare's rate was below the 35.5% average, yet it had the most third-party breaches by count, at 78.

The US rate of 30.9% sat below the 35.5% global average in this sample. Singapore at 71.4% and the Netherlands at 70.4% topped the list.

Verizon 2026 DBIR industry snapshots: incidents, confirmed breaches and third-party share

Source: Verizon Business, 2026 Data Breach Investigations Report: Executive Summary. Download as image

Verizon 2026 DBIR regional snapshots: incidents, confirmed breaches and third-party share

Source: Verizon Business, 2026 Data Breach Investigations Report: Executive Summary. Download as image

How Verizon's DBIR defines a third-party breach (three vendor relationship types)

Source: Verizon Business, 2026 Data Breach Investigations Report. Download as image

What counts as a third-party data breach?

Verizon counts a breach as third-party when a vendor or partner played a part, even if the attacker ended up inside your own systems. It groups these into three types, shown in the table above.

The first is your software supply chain. A product you installed had a flaw or a planted back door, the way SolarWinds did. The second is a vendor that holds your data, like the campaign against Snowflake customer accounts, where stolen logins opened up data stored with the vendor. The third is a vendor with a connection into your network. The Target breach is the textbook case: attackers got in through a vendor's access and moved from there.

For a small business, all three are familiar. Your bookkeeping app, your file-sharing service and the IT contractor who has remote access to your laptops each fit one of these boxes.

For a freelancer, the list is shorter but the same idea holds. Your invoicing tool, cloud storage and email provider hold client files and payment details. If one of them leaks, your client may ask what your contract with them promised about protecting their data.

How common are third-party breaches in 2026?

Very. In the 2026 DBIR, which looked at more than 22,000 confirmed breaches in 145 countries, 48% involved a third party. The 2025 edition put it at 30%, and the 2024 edition at 15%. The share roughly tripled in two years.

Two caveats keep the number honest. Verizon's data is global, and the North American figure is lower at 43%. SecurityScorecard, using a different sample of 1,000 breaches from 2024, found a third-party share of 35.5% worldwide and 30.9% in the US. The methods differ, so don't compare the two figures directly. Both point the same way, though: roughly three to five in ten breaches now run through a vendor.

Ransomware follows the same route. SecurityScorecard found that 41.4% of ransomware attacks in its sample started through a third party. One compromised vendor can mean dozens of customers locked out at once, which is why attackers like these targets.

Why are small businesses hit so often through vendors?

In the 2026 DBIR, 55% of breaches at small and medium-sized businesses involved a third party. That is above the overall rate, and it makes sense. A small company rarely runs its own email servers, payroll engine or customer database. It rents them. Every one of those subscriptions is a door someone else holds the key to.

The fix is often slow on the vendor side too. Verizon tracked third-party cloud accounts with missing or weak multi-factor login protection, and only 23% of those organizations fully fixed the problem. You can't force a vendor to patch faster, but your contract can make the cost of not doing so theirs rather than yours.

Employees feel this too. When the HR or payroll platform your employer uses is breached, your Social Security number and bank details may be in the leaked files, even though you never signed anything with that vendor.

Which industries carry the most vendor risk?

Retail tops both studies. In the 2026 DBIR, 68% of retail breaches involved a third party, and SecurityScorecard put retail and hospitality at 52.4%. Think about how a shop runs: payment processors, ecommerce platforms, loyalty apps, shipping integrations, marketing tools. Each one touches customer data.

Manufacturing was next at 61%. Plants depend on equipment makers, logistics partners and outside IT support, many with remote access to keep machines running.

Healthcare is the odd one. Its share was 32% in the DBIR, the lowest of the industries shown, and its SecurityScorecard rate of 32.2% was below average. Yet healthcare had the most third-party breaches by count in that sample, 78 of them. A lower rate in a big, busy sector can still mean a lot of breaches.

If you work in one of the high-share industries, assume your vendors are a main way in. If you are in a lower-share one, don't relax. The overall figure is still close to half.

Who pays when a vendor leaks your data?

Usually you do, unless the contract says otherwise. Your customers and regulators will look to the company they gave their data to. Breach notice laws put the duty to notify on the business that owns the data, and that duty doesn't go away because a vendor caused the leak.

Then you turn to the vendor and find the liability cap. Many standard software terms limit what the vendor owes you to the fees you paid over a short window, sometimes just a month or a year. If you pay a small monthly fee and the breach costs you thousands in notification letters, credit monitoring and lost clients, that cap covers almost none of it.

This is where the numbers above become practical. If close to half of breaches involve a vendor, the vendor's contract is part of your security plan, whether or not you read it.

What to do before you sign a vendor contract

• Make a short list of every vendor that stores your data or can log into your systems. Most small businesses find more than they expected.
• For each one, find the security section of the terms. Look for named standards, such as a SOC 2 report, rather than vague promises of reasonable care.
• Check how fast the vendor must tell you about a breach. A fixed window in hours or days beats "promptly" or "without undue delay."
• Read the liability cap and see whether data breaches are carved out with a higher limit.
• Ask if the vendor carries cyber insurance and if you can see proof of it.
• Turn on multi-factor login for every vendor account you control. In the Snowflake case, attackers used stolen logins to customer accounts that had no multi-factor protection.
• Know how to get your data back and have it deleted when you leave. Data a vendor keeps after you cancel is still your exposure.

Sources and method

Every number on this page comes from the sources below, each opened and read on or before October 18, 2026. A second, independent review checked every figure against its source and corrected anything that did not match. Figures that could not be confirmed were left out.

1. Verizon Business, 2026 Data Breach Investigations Report: Executive Summary (2026 edition (19th DBIR), May 2026; incidents November 1, 2024 to October 31, 2025)
2. Verizon Business, 2026 Data Breach Investigations Report (2026 edition (19th DBIR), May 2026)
3. Verizon Business, 2025 Data Breach Investigations Report: Executive Summary (2025 edition (18th DBIR), April 23, 2025)
4. Verizon, Verizon's 2025 Data Breach Investigations Report: Alarming surge in cyberattacks through third-parties (April 23, 2025)
5. Verizon, 2024 Data Breach Investigations Report: Vulnerability exploitation boom threatens cybersecurity (May 1, 2024)
6. SecurityScorecard, SecurityScorecard 2025 Global Third-Party Breach Report Reveals Surge in Vendor-Driven Attacks (March 26, 2025 (2025 Global Third-Party Breach Report))