A new Kroll report finds that more than two-thirds (69%) of data breach victims in the past year were affected by a third-party breach, with 79% of those individuals’ data accessed following a compromise at a technology company during June 2025 to June 2026. The impact is disproportionately connected to technology firms, which accounted for 60% of the total number of breach victims over the same 12-month window, even though the tech sector represented only about 6% of breach incidents overall.
The findings also show a mismatch between incident frequency and victim reach: while finance and professional services each accounted for around 20% of breaches, technology caused far more victims due to the domino effect of vendor or service-provider breaches. Denyl Green, Kroll’s global head of breach notification, notes that in many major incidents the link between the initial breach and affected organisations was a vendor or software supplier.
The report references activity by cybercriminal groups such as Scattered Spider targeting IT service providers and, in October 2026, a Chinese nation-state actor gaining access to ConnectWise’s cloud infrastructure to reach downstream customers. The study emphasises that breaches originating in a tech vendor can propagate broadly, affecting organisations and individuals far removed from the original compromise.