Should entities be required to disclose the name of a vendor if the breach was at the vendor’s?

The piece questions whether entities should be required to disclose the name of a vendor when a breach occurred at the vendor’s. It highlights a November notification from Cigna Healthcare to the Massachusetts Attorney General’s Office, showing that the third‑party vendor’s incident involved unauthorized access and affected data such as claim overpayment and recovery files.

The timeline reported indicates the vendor was notified on 15 January 2025, did not confirm that Cigna’s data was impacted until 3 September 2025, and identified affected data between 23 and 29 September 2025, with the incident itself dating from 21 October 2024 to 13 January 2025. The letter states that the vendor later restored systems and notified law enforcement.

The piece notes that because the vendor’s identity is not disclosed, researchers will have a harder time assessing the scope of the breach and identifying other affected clients. According to Massachusetts Attorney General’s Office, Cigna’s dissatisfaction with the unnamed vendor is evident, and ongoing third‑party oversight and security assessments are mentioned as aligning with regulatory expectations.