Kroll Data Breach Outlook 2026: Third-party breaches hit 69% of victims, with technology-sector compromises behind 79% of them
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 27/10/2026 00:01; os links antigos trazem para cá.
The Kroll Data Breach Outlook 2026 report, published on October 22, finds that 69% of breach victims between June 2025 and June 2026 were affected through a third-party/vendor breach (infosecurity-magazine.com, hipaajournal.com). In 79% of those cases the data was accessed after a compromise of a technology company. Technology firms were the origin of 60% of all affected individuals, yet ranked only 7th by number of organizations breached and made up about 6% of observed incidents (infosecurity-magazine.com). The report draws on incidents Kroll handled and a survey of 250 risk/compliance leaders and executives (hipaajournal.com). It also reports that 69% of surveyed organizations had a breach in the past 12 months and 34% had more than one. Denyl Green, Kroll's global head of breach notification, said a vendor, software supplier or service provider linked the initial breach to the affected organizations in most major incidents. The data shows how a single vendor compromise can cascade to many downstream organizations and individuals.
Detalhes técnicos
- Share of all affected individuals by originating sector: technology 60%, insurance 10%, finance 8%, healthcare 8% (both sources). Education was 7.5% (infosecurity-magazine.com).
- Share of individuals affected by third-party breaches by sector: technology 79%, finance 9%, insurance 6%, healthcare 5% (both sources).
- Most breached sectors by incident count: finance and professional services (about 20% each), healthcare 15%, retail 8% (infosecurity-magazine.com). Healthcare fell to third place, its lowest ranking since 2022 (hipaajournal.com).
- Survey: 54% of IT and technology leaders ranked vendors/third parties as their biggest compliance risk, versus 39.7% of the C-suite and 30.4% of dedicated risk and compliance leaders (hipaajournal.com).
- Context outside the Kroll report: HHS OCR data for 1 Jan to 30 Sep 2026 shows 593 large healthcare breaches. Of these, 79% occurred at HIPAA-covered entities and 21% at business associates, yet business associates account for 41% of affected individuals (hipaajournal.com).
- Threat context: actors such as Scattered Spider target IT service providers to reach customers' systems. The article also cites an October 2026 report that a Chinese nation-state actor accessed ConnectWise's cloud infrastructure, enabling targeting of downstream customers. This is secondary context in the article and is not part of the Kroll findings (infosecurity-magazine.com).
Remediação
The sources give no formal remediation guidance. Their findings point to treating vendor and supplier risk as a primary exposure, especially for technology and service providers with access to customer systems (both sources).
Relatos divergentes
- The 69% figure is framed differently. infosecurity-magazine.com presents it as the share of breach victims reached through third parties, and also as the share of surveyed security leaders reporting a breach. hipaajournal.com presents it as the share of affected individuals tied to vendor breaches, and separately as the share of organizations that had a breach. The two sources are consistent on the underlying numbers. hipaajournal.com, which cites the survey sample and period, is the more detailed account.
Linha do tempo
-
Kroll report: vendor breaches affected 69% of breach victims; healthcare falls to third in breach volume
ler a análise desta fonte ocultar
The Kroll Data Breach Outlook 2026 report, based on incidents Kroll handled between June 2025 and June 2026 and a survey of 250 risk/compliance leaders and executives, finds that 69% of organizations experienced a data breach in the past year and 34% experienced more than one. Third-party/vendor breaches accounted for 69% of all affected individuals, and 79% of individuals affected by third-party breaches were hit through incidents in the technology sector. Finance ranked first for breaches, followed by professional services, while healthcare dropped to third (15% of Kroll-handled breaches), its lowest ranking since 2022. Technology ranked 7th by organizations breached but accounted for 60% of all affected individuals. Kroll's Denyl Green said a vendor, software supplier or service provider was the link between the initial breach and the affected organizations in most major incidents.
Technical Details
- Sector share of all affected individuals: technology 60%, insurance 10%, finance 8%, healthcare 8%.
- Sector share of individuals affected by third-party breaches: technology 79%, finance 9%, insurance 6%, healthcare 5%.
- HHS OCR data for 1 Jan to 30 Sep 2026 (not part of the Kroll report): of 593 large healthcare breaches, 79% occurred at HIPAA-covered entities and 21% at business associates, yet business associates account for 41% of affected individuals.
- In Kroll's survey, 54% of IT and technology leaders ranked vendors/third parties as their biggest compliance risk, versus 39.7% of the C-suite and 30.4% of dedicated risk and compliance leaders.
-
Kroll: Tech Sector Compromises Drive 79% of Third-Party Breach Victims; 69% of Victims Hit via Third Parties
ler a análise desta fonte ocultar
A Kroll report published on October 22 finds that 69% of data breach victims over June 2025 to June 2026 were affected through a third-party breach. In 79% of those cases, the data was accessed after the compromise of a technology company. Finance (9%), insurance (6%) and healthcare (5%) accounted for far smaller shares of third-party-sourced victims. Technology firms caused 60% of all breach victims, yet made up only 6% of observed incidents and were the seventh most commonly breached sector. This shows that one vendor compromise can cascade to many downstream organizations and individuals.
Technical Details
- Share of all breach victims by originating sector: technology 60%, insurance 10%, finance 8%, healthcare 8%, education 7.5%.
- Most breached sectors by incident count: finance (20%), professional services (20%), healthcare (15%), retail (8%).
- Among security leaders surveyed, 69% reported a breach in the previous 12 months and 34% reported more than one.
- Denyl Green, global head of breach notification at Kroll, said that in most major incidents handled, a vendor, software supplier or service provider linked the initial breach to the affected organizations.
- The article notes that actors such as Scattered Spider target IT service providers to reach customers' systems. It also notes an October 2026 report that a Chinese nation-state actor accessed ConnectWise's cloud infrastructure, enabling targeting of downstream customers.