A vendor data breach happens when one of your suppliers, software providers, or service partners gets hacked and your data (or your customers’ data) walks out the door with the attacker. Somerset Regal Bank learned this the hard way in early 2025 when unauthorized access at a vendor exposed customer files containing personal information. The bank’s own systems stayed secure, yet it still faced the legal duty to notify affected customers, the public relations headache, and the regulatory scrutiny that comes with any breach.
For small and mid-sized businesses, the lesson is stark. You can do everything right inside your four walls and still end up in crisis because someone you hired to process payroll, host your CRM, or manage backups had a weak password policy or an unpatched server.
This is not a distant risk. Studies show that more than half of all breaches now involve a third party somewhere in the chain. And regulators know it. HIPAA, the FTC Safeguards Rule, and the Cybersecurity Maturity Model Certification (CMMC) all explicitly hold you accountable for your vendors’ security practices.
Why Am I Liable for a Vendor Data Breach?
Because the law treats your vendors as extensions of your business. When you hand customer Social Security numbers to a payroll processor or patient health records to a cloud billing platform, you remain the custodian of that data in the eyes of regulators and courts.
HIPAA calls these vendors “business associates” and requires you to sign contracts that spell out their security obligations. The FTC Safeguards Rule (binding on financial services firms, insurance agencies, and mortgage brokers) demands that you assess and continuously monitor every service provider with access to customer information. CMMC Level 2 and Level 3 require defense contractors to audit subcontractors’ cybersecurity controls before sharing Controlled Unclassified Information (CUI).
If a vendor fails and customer data leaks, state breach notification laws still trigger for you. You pay for the credit monitoring, you mail the letters, you field the angry calls, and you face the potential class-action lawsuit. The vendor may be contractually required to indemnify you, but collecting on that promise after they’ve declared bankruptcy or vanished is another story entirely.
What Should I Ask Every Vendor Before Signing?
Six questions will help you separate vendors who take security seriously from those who treat it as a checkbox exercise.
1. Do you encrypt our data at rest and in transit? Encryption is table stakes. If they store your data on servers, it should be encrypted using AES-256 or equivalent. If they move it over the internet, they should use TLS 1.2 or higher. Ask for specifics, not vague assurances.
2. How do you control who accesses our data? Multi-factor authentication (MFA) should be mandatory for every account that touches your information. Role-based access control means that a billing clerk cannot see the same data as a system administrator. If the vendor cannot describe how they limit access, walk away.
3. What is your incident response plan, and how quickly will you tell us? Somerset Regal Bank discovered the breach when the vendor notified them. But how fast was that notification? Days? Weeks? Your contract should specify a maximum window (24 to 48 hours is reasonable) for the vendor to inform you of any suspected or confirmed breach. You also want to see evidence that they have a written incident response plan and test it regularly.
4. Do you carry cyber liability insurance? A policy with at least $1 million in coverage shows the vendor takes breach risk seriously enough to transfer some of it to an insurer. It also means there is a pot of money available to help pay for remediation if things go wrong. Ask for a certificate of insurance and verify the policy is current.
5. Can we audit your security controls? You may not have the budget to conduct your own penetration test of a vendor’s infrastructure, but you can require them to complete an annual SOC 2 Type II audit or to fill out a standardized security questionnaire (such as the Consensus Assessments Initiative Questionnaire used in cloud services). For CMMC purposes, defense contractors must verify that subcontractors meet NIST SP 800-171 requirements and document that verification.
6. What happens to our data when the contract ends? Data destruction procedures matter. You want a written commitment that the vendor will delete or return all your data within 30 days of contract termination and provide a certificate of destruction. Stray copies sitting on decommissioned backup tapes are a common source of later breaches.
How Do I Document Vendor Risk for an Audit?
Auditors and regulators want to see a vendor risk management program, not a pile of contracts. Here is what that looks like in practice for a 20-person law firm, a 50-employee manufacturer, or a three-location medical practice.
Start with an inventory. List every vendor that touches, stores, or transmits sensitive data (client files, employee payroll, patient records, credit card numbers, CUI). Include the obvious ones (your email provider, your accounting software vendor, your EHR platform) and the easy-to-forget ones (the IT support company that has domain admin rights, the offsite backup service, the third-party call center).
Next, classify each vendor by risk. High-risk vendors have access to large volumes of sensitive data or have administrative access to your core systems. Medium-risk vendors touch some sensitive data but in limited ways. Low-risk vendors provide services that do not involve access to confidential information. You will spend the most time assessing and monitoring high-risk vendors.
For each high-risk vendor, collect evidence: the signed Business Associate Agreement (for HIPAA), the completed security questionnaire, the SOC 2 report, the certificate of insurance, the contract clause that grants you audit rights and specifies breach notification timelines. Store these documents in a folder (digital or physical) that you can produce when an auditor or attorney asks for them.
Review this inventory at least annually. Vendors change ownership, they add new subcontractors, they move data to new data centers. An annual refresh lets you catch drift before it becomes a crisis.
What Are the Real Costs of a Vendor Data Breach?
Somerset Regal Bank said it expects no material financial impact from its vendor breach, but that statement covers only direct losses such as fraud. The full cost picture is wider.
Breach notification letters cost $1 to $3 per affected individual when you include printing, postage, and call-center setup. If 10,000 customers are affected, you are looking at $10,000 to $30,000 before you have even addressed the root cause. Credit monitoring services (often required by state law or offered to reduce lawsuit risk) run $15 to $25 per person per year. For the same 10,000 people, that is $150,000 to $250,000.
Legal fees add up fast. Responding to state attorneys general, defending against class actions, and negotiating settlements can easily reach six figures even for mid-sized incidents. Forensic investigation to determine what data was accessed and when typically costs $20,000 to $50,000.
Then come the regulatory fines. A HIPAA violation involving a business associate can result in penalties up to $1.5 million per year for each requirement violated if the breach is deemed to result from willful neglect. The FTC has extracted settlements in the millions from companies that failed to vet their service providers. Even if your final fine is smaller, the cost of the investigation, the remediation plan, and the ongoing monitoring the regulator will demand can exceed the headline number.
Reputation damage is harder to quantify but no less real. Clients leave. Prospects google your company name and find breach headlines. Your sales team spends the next year answering the question, “How do I know this won’t happen again?”
How Does This Fit Into HIPAA, CMMC, and FTC Safeguards?
Each major compliance regime treats vendor risk slightly differently, but the core principle is identical: you are responsible.
HIPAA requires covered entities (healthcare providers, health plans, clearinghouses) and business associates to enter into written agreements that specify the permitted uses of protected health information and require the business associate to implement safeguards. The breach notification rule applies whether the breach happens at the covered entity or at the business associate. Recent enforcement actions have targeted both parties, and the Office for Civil Rights has made vendor oversight a focus area in audits.
The FTC Safeguards Rule, which applies to financial institutions (including mortgage brokers, accountants offering tax prep and financial planning, and insurance agencies), was amended in 2023 to require firms to implement a vendor risk management program. Specifically, you must periodically assess your service providers, require them by contract to maintain appropriate safeguards, and review their performance. The rule does not prescribe exactly how to do this, but it does require that you document what you have done.
CMMC (Cybersecurity Maturity Model Certification) Level 2 and Level 3 require defense contractors to verify that all subcontractors handling CUI meet the same NIST SP 800-171 controls. This means you cannot simply accept a subcontractor’s word. You must review evidence (a certification, a self-assessment, or an independent audit report) and document that review. If a subcontractor later fails and CUI is exposed, the prime contractor bears the consequences: loss of the contract, suspension from future awards, and potential False Claims Act liability if the contractor falsely certified compliance.
Do I Need a Formal Vendor Risk Program, or Is a Spreadsheet Enough?
It depends on your size, your industry, and your regulatory obligations. A three-person accounting firm with five vendors can manage the process in a spreadsheet. A 100-employee manufacturer with 40 vendors touching production data, employee records, and customer orders will benefit from a more structured program and possibly a dedicated governance, risk, and compliance (GRC) platform.
The spreadsheet approach works if you keep it current. Columns should include vendor name, services provided, data accessed, risk tier, date of last security review, contract renewal date, insurance status, and any audit findings. Update it when you onboard a new vendor, when a contract renews, and at least once a year for all vendors.
A formal program adds processes: a vendor onboarding checklist that cannot be bypassed, a security questionnaire that every high-risk vendor must complete, a remediation tracker for any gaps identified, and a regular report to leadership on vendor risk posture. If you are preparing for a CMMC Level 2 assessment, undergoing a SOC 2 audit of your own, or facing an upcoming HIPAA compliance review, a formal program will save time and reduce surprises.
What Should I Do Right Now?
Start with your top five vendors ranked by access to sensitive data. For each one, ask yourself: Do I have a signed agreement that spells out their security obligations? Have I seen evidence of their security controls in the past 12 months? Do I know how quickly they will notify me if they suffer a breach?
If the answer to any of those questions is no, schedule a conversation with the vendor this week. Request a copy of their most recent SOC 2 report or ask them to complete a security questionnaire. If they push back or cannot provide answers, that is a red flag. You may need to find a replacement or at least reduce the data you share with them until they can demonstrate adequate controls.
Next, review your contracts. Many SMBs sign vendor agreements without reading the liability and indemnification clauses. Look for language that requires the vendor to indemnify you for breaches, that grants you the right to audit, and that specifies breach notification timelines. If your current contracts are silent on these points, add them at the next renewal.
Finally, document what you have done. Compliance is not just about doing the right things but also about proving you did them when an auditor, attorney, or regulator asks. A simple log that records the date you requested a SOC 2 report, the date you received it, and any follow-up actions taken will put you miles ahead of most small businesses.
How Can a Guide Help Me Build This Program?
Most SMB owners do not have the time or the technical background to evaluate vendor security controls on their own. That is where a trusted technology partner comes in. A managed service provider (MSP) with a compliance focus can help you build a vendor inventory, draft security questionnaires, review vendor audit reports, and maintain the documentation you need for regulatory audits.
The MSP is not the hero of your story. You are. You are the business owner who decided that protecting customer trust and avoiding regulatory fines was worth the investment in a real vendor risk program. The MSP is the guide who hands you the map, walks you through the process, and makes sure you do not miss a step. When the next Somerset Regal Bank headline hits, you will be able to reassure your customers (and yourself) that you have done the work to prevent the same thing from happening to you.
Keep reading
- compliance and regulatory exposure
- cybersecurity and data breach risk
- explore how TC3 helps SMBs solve these challenges
Sources
Source: SR Bancorp reports vendor data breach affecting certain customer records – TradingView