Kroll’s 2026 Data Breach Outlook, published on Thursday, found that 69% of individuals affected in incidents it handled between June 2025 and June 2026 had been exposed through breaches involving third parties. Of that group, 79% were linked to compromises in the technology sector, far exceeding the shares attributed to financial services, insurance and healthcare.
The findings highlight the disproportionate reach of attacks against software suppliers and other technology providers whose systems hold information for numerous business customers. A single compromised supplier can expose individuals associated with dozens or hundreds of organisations, even when those organisations’ own networks have not been directly penetrated.
Technology accounted for 60% of all affected individuals across Kroll’s examined cases, despite ranking only seventh by the number of organisations breached. Insurance ranked ninth on the latter measure but second for the number of individuals affected, illustrating how the size of a breach can differ sharply from its frequency.
Financial services nevertheless remained the sector with the largest share of breached organisations, representing 20% of incidents handled by Kroll. Professional services also accounted for 20%, moving into second place in the firm’s sector analysis, with its breach count rising 45% compared with the previous report.
Among people affected by third-party breaches, financial services accounted for 9%, insurance 6% and healthcare 5%, compared with technology’s 79%. These percentages describe individuals in Kroll’s caseload rather than the proportion of all cyberattacks worldwide, and do not establish that technology companies experienced the greatest number of intrusions.
A separate survey of 250 organisational leaders conducted for the report found that 69% said their businesses had suffered at least one data breach during the preceding 12 months. More than one-third, or 34%, said they had experienced multiple breaches, indicating that repeated exposure was a substantial concern among respondents.
The survey also identified differences in how executives assess supplier-related risks. Some 54% of IT and technology leaders identified vendor and third-party breaches as their biggest compliance risk, against 40% of chief executives and other senior corporate officers and 30% of risk and compliance leaders.
Dependence on external suppliers was among the four leading challenges affecting breach-response decisions, cited by 41% of respondents. Such dependencies can complicate efforts to establish what information was compromised, identify the organisations responsible for notifications and determine which customers require assistance.
Denyl Green, Kroll’s global head of breach notification, said suppliers frequently connected an initial security incident to a much wider group of affected organisations. He explained that businesses and individuals could be exposed without having any direct relationship with the company where the compromise originated.
Green said organisations responding to supplier breaches must establish whose information was affected and whether notification obligations apply to customers and regulators. Mapping relationships with suppliers before an incident, he added, could reduce the complexity and expense of the response.
The findings also carry implications for cyber insurers. Katherine Keefe, Kroll’s global cyber insurance industry lead, said one compromised provider could generate claims from numerous businesses using the same service, concentrating potential losses across insurance portfolios.
Keefe said insurers were examining supplier dependencies more closely to identify common points of failure. Underwriters and claims teams face particular challenges when several policyholders suffer consequences from the same intrusion, requiring coordinated investigation, notification and claims management.
Other industry research points to the importance of external providers, although it measures breaches differently. Verizon’s 2026 Data Breach Investigations Report found third-party involvement in 48% of breaches examined, an increase of 60% from the preceding year. That figure concerns the share of breach incidents, rather than the share of individuals affected, and is therefore not directly comparable with Kroll’s findings.
Kroll also identified artificial intelligence as an emerging consideration in supplier security. Green warned that granting AI agents greater access to corporate systems and sensitive information could increase exposure involving both human and machine identities. He said identity governance was becoming more complex as businesses introduced autonomous tools into existing technology environments.
Kroll’s assessment combines incidents managed by its cyber and data resilience practice with responses from corporate leaders. The company said its analysis covered the twelve months ending in June, while the accompanying leadership survey was conducted during 2026.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
