Tech Supplier Hacks Account for Nearly Seven‑In‑Ten Breaches, Kroll Report Shows

A new analysis by security firm Kroll reveals that 69% of organizations hit by data breaches over the past year suffered the intrusion through a third‑party relationship, with attacks on technology providers emerging as the leading trigger.

The study classifies a third‑party breach as any incident where an external vendor, cloud service, or software platform compromises the data of its client. As enterprises increasingly outsource critical functions to specialized firms, the attack surface expands, making it easier for cybercriminals to exploit weaker links in the supply chain.

Technology companies, ranging from software developers to cloud infrastructure operators, topped the list of compromised entities. Their pervasive integration into corporate IT environments means that a single vulnerability can cascade across dozens of downstream customers, amplifying the impact of each breach.

Industry observers note that the findings underscore a growing regulatory focus on supply‑chain risk. Laws such as the EU’s Digital Services Act and emerging U.S. state legislation are pushing firms to conduct more rigorous due‑diligence on vendors and to adopt continuous monitoring practices. For many businesses, the report serves as a warning that traditional perimeter defenses are insufficient when critical data passes through external platforms.

Looking ahead, experts recommend that organizations treat third‑party risk as a core component of their cybersecurity strategy. Measures include mandating security certifications for suppliers, implementing zero‑trust architectures, and regularly testing the resilience of integrated services. As the Kroll data suggests, strengthening these defenses could substantially reduce the proportion of breaches that stem from external tech partners.