The essentials
- Your exposure equals the vendor's access plus the vendor's storage: credentials, API keys, network paths, and your data on their systems.
- Rotate every credential and key the vendor held or could see — now, without waiting for their final forensics report.
- An MSP or IT provider with admin access is the maximum-severity case: treat it as potential direct compromise of your own environment.
- Ask the vendor pointed written questions; their first notice is usually vague by design.
- Expect phishing that impersonates the breached vendor within days — attackers ride the news.
Supply-chain exposure is other people's security becoming your problem: the invoicing platform that stores your customer list, the MSP with a domain admin account, the SaaS tool with an always-on API key into your systems.
When a vendor announces a breach, their language will be careful and their details thin. Your response cannot wait for their clarity — act on what they could reach, not on what they have so far admitted.
Do this now
- Inventory the blast radius. What credentials, keys, certificates, and network access does this vendor hold? What data of yours sits on their systems? Write it down — this list drives everything.
- Rotate and revoke. Every credential, API key, token, and certificate the vendor held gets rotated; dormant integrations get disabled. Do not wait for the vendor's report to do your side.
- Watch the vendor-shaped paths. Heighten monitoring on VPN accounts, service accounts, and integrations tied to the vendor — logins, timing, and volume anomalies especially.
- Question the vendor in writing. What was accessed and when, was our data or tenant affected, were credentials or keys taken, what persistence was found, who is doing their forensics. Written answers age into evidence.
- Check the contract. Notification obligations, audit rights, security commitments, liability. Counsel reads it now, not after the vendor's final report.
- Warn your staff. A short note: expect phishing referencing the vendor's breach; verify anything unusual through known channels.
What not to do
- Do not assume "no evidence of customer impact" means no impact — it often means no logs.
- Do not wait for the vendor's forensics before rotating what they held.
- Do not overlook dormant integrations and forgotten service accounts — attackers don't.
- Do not rely on the vendor's phone call as your record; get it in writing.
- Do not skip your own log review because the breach was "theirs".
Preserve the evidence
Whatever else happens, these are the artifacts the investigation — and any insurance claim, dispute, or prosecution — will be built from:
- Your access-and-data inventory for the vendor.
- Rotation and revocation log with timestamps.
- All vendor communications, preserved.
- Your own monitoring findings on vendor-linked paths.
Keep a clear head
There is a particular helplessness in incidents you didn't cause and can't investigate directly. Counter it with the part that is fully yours: the inventory, the rotation, the monitoring, and the written questions. Your side of the boundary can be made clean regardless of theirs.
Questions victims ask
The vendor says customer data wasn't affected. Can we stand down?
Downgrade, don't stand down. Early vendor statements minimize by default and are sometimes revised months later. Keep the rotation done, the monitoring elevated for a few weeks, and the written record of what they claimed.
Our MSP had full admin access to everything. How bad is this?
That is the worst case in this category — an MSP compromise is a direct path into client environments, and attackers use exactly that. Treat it as a potential intrusion of your own network: rotation, log review, and possibly professional scoping of your environment, not just theirs.
Do we need to notify our customers about our vendor's breach?
If your customers' data was on the vendor's systems, possibly yes — the duty often follows the data, not the contract boundary. It hinges on what was actually exposed, which is why the written vendor answers and your own inventory matter.