The Breaches Brief, Issue 2, October 2026.
If a vendor got breached today, could you tell a worried customer by end of day whether their data was in it? Most firms need about a week to find out, because nobody wrote down who holds what before the breach happened, which is exactly the hole a vendor breach response plan is built to fill. The firms that answer in ten minutes instead of a week aren’t luckier. They wrote the list down before they needed it. That’s the whole difference. Not better luck, not a bigger budget, just a document that already exists when the phone rings.
A week of silence costs you more than time. If a customer or patient asks whether their information was exposed and you can’t answer by end of day, you’ve told them something true about how you run the business, whether you meant to or not. Here is what happened this month, and what it means if you’re running a firm this size.
What does it cost to skip a vendor breach response plan?
Twin Cities Pain Clinic just settled litigation over a breach that exposed patient data. For a healthcare practice, or any professional services firm holding client records, the lesson isn’t the breach itself. It’s the aftermath: settlements, legal fees, and notification costs that outlast the headline by years. If you hold sensitive client data and don’t have a written incident plan, this is the bill you’re exposed to.
The pattern holds across every breach the industry tracks: the breach makes headlines for a day, the response bills arrive for years. A written plan doesn’t prevent the breach. It just shortens the aftermath and keeps the client relationship intact.
What happened this month in vendor and third-party breaches?
Lockbit5 has published a new victim: Kord Hotels in Santorini. A hospitality group got hit, and bookings, guest data, and operations all stopped at once. If your business runs on reservations or appointments, that’s your worst Monday, and it can start with a single stolen vendor login.
Emperador has published a new victim: MyM Odontoclinica, a dental practice. Financial and patient records were stolen in the same breach. Small medical and professional offices are exactly the size these groups prefer. They hold records worth selling and rarely have the defenses a larger health system does.
Two more worth noting. Aurora listed Estrategias BigMat, a building materials distributor, after payroll and tax data for employees and customers was taken, which means a notification letter to every person on that payroll. And Ahold Delhaize took systems offline after a cyberattack. A retail giant can absorb that and keep stores open. A smaller operation running the same systems usually can’t.
What’s the one thing that actually matters here?
When a vendor gets breached, the question lands in your inbox the same day: was our data in there? Most firms need a week to answer, because nobody keeps a current list of who holds what. The ones who answer in ten minutes aren’t luckier. They wrote the list down before they needed it.
What should you do this week?
Start the plan now, while nothing is on fire. It takes three steps.
- List every vendor and system that touches sensitive data, in a document you can find in thirty seconds, not thirty minutes.
- Write down who gets notified, and in what order, if a vendor tells you they were breached.
- Test it once, on paper, before you need it for real.
Most firms stall at step one because the list feels like an IT project. It isn’t. It belongs to whoever answers the phone when a client calls asking a question, which means it belongs to the whole company, not a single department.
Grab TC³’s Incident Response Template and fill in the blanks this week, not the week after something happens. For more on where your industry sits on breach exposure, see our data breach risk overview, and browse more stories behind the headlines in our cybersecurity news coverage.
Can TC³ build this for us?
TC³ can help you build that vendor list and the notification plan before you’re under pressure to write one. We don’t run your breach response once it’s underway. That’s a job for an incident response firm. What we do is make sure you’re not starting from zero when the call comes in. Think of it like a fire extinguisher. You hope to never need it, but you want it mounted on the wall before the smoke starts, not while the kitchen is burning.
The only thing faster than ransomware is how fast everyone asks whether you were using that vendor.
Catch up on past issues of The Breaches Brief, and subscribe to get the next one in your inbox.
This article was drafted with AI assistance and reviewed by TC³’s team before publishing.
Researched and drafted with AI, then reviewed and approved by Ron Trotto before publishing.