Tech teamRunning a website or small org
Third-party / vendor breach
Your data exposed because a supplier was breached.
Understand it
You can do everything right and still be exposed, because a supplier holding your data, or with access to your systems, was the one attacked. A good many large UK incidents began at a smaller supplier.
How to spot it
A supplier reporting an incident, or your data appearing where it should not.
Close the gap
- Know which suppliers hold, or can reach, your data - keep a list.
- Ask about their security before trusting them.
- Give each the least access needed, and withdraw it when done.
- Have a plan for the day a supplier is breached.
What to do about it
This sits with whoever builds and runs your website or systems - it’s beyond what a personal plan should promise to fix. If that’s not you, hand it to whoever looks after your security. We’d rather be honest about where we stop.
Your own accounts and devices are still worth protecting; your plan covers those.