ISO27K

Seven in ten breach victims were exposed through somebody else's supplier

November 3, 2026. From issue 13 of The Compliance Brief, one story for teams running an ISO 27001 or ISO 42001 management system.

Last reviewed 2026-11-03Written by Jacob Masse, TrazTech Inc.

Issue 13 of The Compliance Brief was published on November 3, 2026. One of its 5 stories bears on ISO 27001, ISO 42001 and supplier risk, and they are below in short form. The full issue, with every take in full, is on traztech.ca.

Source: Help Net Security

Kroll's Data Breach Outlook 2026 reports that nearly seven in ten people affected by breaches it handled were exposed through an outside supplier rather than the company they dealt with directly. The report notes that businesses depend on outside providers to store data, process transactions and run software.

Our take, in short

Read that from the other side of the table, because you are the outside supplier in someone else's version of this report. Numbers like these are exactly what feeds the next generation of vendor questionnaires, so expect more questions about your subprocessors, your own vendor reviews and what happens to customer data when one of your providers is compromised.

Read the full take on traztech.ca

Also in issue 13

Outside ISO 27001, ISO 42001 and supplier risk, but in the same email:

Older: issue 12 All issues on ISO27K