Your Vendor's Vendor Can Burn You

In today’s interconnected digital landscape, our reliance on vendors is greater than ever. But what happens when a trusted vendor gets breached? 
This question has been at the forefront of recent discussions in the tech world.

Vendor breaches occur when a third-party service provider’s system is compromised, leading to data leaks not directly from the main company, but from its supporting vendors. Recently, significant incidents involving reputable companies like Ernst & Young, Salesforce, and Framework have shed light on the risks associated with vendor breaches.

One of the more notable discussions centered around Ernst & Young. The breach, which occurred between March and April 2026, wasn’t disclosed until July. This 83-day delay in communication underscores the importance of timely disclosure. During this time, sensitive information, including names, addresses, and financial data, was compromised. The importance of quick, transparent communication following a breach cannot be overstated, yet it’s often overlooked in favor of damage control.

Salesforce’s recent woes provide another cautionary tale. A hack initially affecting Salesforce extended to other organizations, such as Alcon and Luminus. Through tactics like social engineering, hackers exploited IT support processes, resulting in as many as 1 billion records being compromised. These cases highlight the dangers of interconnected systems and the need for robust cybersecurity practices at every level of an organization.

• Alcon: 25M+ records confirmed exposed.
• Questal: 21M records + 147GB confirmed; the "20,000+ client cascade" figure is unverified, note it as a claim, not confirmed fact.
• Lumenis: details reported but not independently confirmed in our research, flag as unverified.

The "1 billion+ records across ~40 companies" number is an attacker claim that Reuters explicitly said it could not verify. 

Salesforce's stance: platform itself wasn't breached, this was social engineering and integration abuse; refused to pay ransom

Amidst the chaos, Framework stands out for its rapid response to a vendor breach. 
CVE-2026-72898, a critical SQL injection zero-day in Metabase (CVSS 10.0). 
And the data exposed? Names, emails, phones, addresses, login IPs; business customers' VAT/EIN. 

Within just 17 minutes of becoming aware of the breach, Framework implemented full disclosure. This swift action set a benchmark for how companies should handle such incidents and reinforced trust rather than eroding it.

So, how can companies better manage vendor risks? The answer lies in meticulous vendor management and clear protocols for incident response. Companies should regularly audit their vendors, understand the vendors’ own security practices, and ensure they have rapid response plans in place.

Train employees to recognize phishing and social engineering tactics that often act as gateways for cybercriminals. Implementing measures like Multi-Factor Authentication (MFA) is crucial, but staff must be educated on how to handle unusual MFA requests that may be phishing attempts.

With great technological advancement comes the risk of sophisticated cyber threats. However, as long as we remain vigilant, demand transparency, and prioritize security over short-term gains, we can mitigate these risks significantly.

Companies, both large and small, need to foster a culture of openness and accountability. As seen with Framework’s case, companies that handle breaches with transparency can maintain and even bolster customer trust.