Nearly 70% of breach victims didn't know their data was held by a third party

When the breach happens somewhere you didn't know your data was

Kroll's 2026 report on data breach insurance claims found that nearly 70% of victims were exposed through a third-party supplier they had never heard of ^[1]. The customer gave their details to one company, and the breach happened at another.

It's like leaving your coat at a restaurant, only to be told months later that the restaurant sent it to a cleaning service you never knew existed, and that's where someone stole your wallet. You never agreed to the cleaner holding your things, and you certainly didn't check whether they locked their doors.

The problem isn't new, but the scale of it is striking. Most organisations struggle to keep track of which suppliers hold customer data, let alone prove it.

The law doesn't care whose server it was on

Under GDPR, the organisation that collected the data stays responsible for protecting it, even when a supplier processes it ^[2]. If the supplier has a breach, it's the organisation's name in the headlines and the supervisory authority's letter.

Under Sweden's cybersecurity law, which implements NIS2 and has applied since 15 January 2026, suppliers and service providers count as part of ICT risk ^[3]. Essential and important entities have to manage that risk, and they have to report significant incidents: an early warning within 24 hours, an incident notification within 72 hours and a final report within a month.

The deadlines start when the organisation becomes aware of the incident. That's hard to meet if you don't know the supplier exists.

The missing inventory

Most organisations can name their main suppliers. It's the next layer down that gets murky: the suppliers' suppliers, the hosting providers, the analytics platforms, the payment processors.

Someone in procurement signed a contract, someone in IT approved the integration, and someone in marketing added a tracking script. A year later, when an incident response team asks where customer email addresses are actually stored, nobody can give a complete answer.

The question isn't whether the data is somewhere safe. The question is whether you know where it is at all.

What a sealed inventory would look like

Here, the thing to seal is the supplier inventory itself: which suppliers process what categories of data, under which agreements, as of when. Sealing takes a fingerprint of the list, not the list itself, so the details stay internal. The inventory is sealed through WitniumChain using the REST API, the SDK or the MCP server, and the first 2,000 witnesses a month are free ^[4].

Say a new analytics provider is added in March and the contract says they won't hold personal data. In July, during an incident, it turns out they do. With a sealed inventory from February, it's straightforward to show what was documented at the time and when the situation changed.

Anyone the organisation shares the inventory with—an auditor, a supervisor or an insurer—can check that it's the version sealed on that date. If it has changed, even by someone with administrator rights, the fingerprint won't match.

The witness shows that the inventory is the one recorded at a given time, unchanged since. It doesn't show that the inventory was accurate or complete, and it doesn't replace due diligence on suppliers.

How it would work

1. The organisation maintains a supplier inventory (supplier name, categories of data, agreement reference).
2. Each time the inventory is updated—monthly, or when a supplier is added or removed—a fingerprint of the current version is sent to WitniumChain and sealed.
3. During an incident or an audit, the organisation can show which suppliers were documented on a given date, with a record nobody can quietly rewrite.

What this means for you

If you handle customer data, here are three questions worth asking this week:

• Can you list every supplier that currently processes customer data, including your suppliers' suppliers?
• If a breach happened at one of them tomorrow, how long would it take you to know, and how would you show which data they held?
• When did you last update that list, and can you prove what it said six months ago?

Under NIS2, an early warning goes out within 24 hours of becoming aware. If you don't know the supplier exists, the clock never starts.

Sources

1. HelpNet Security, "Third parties responsible for majority of data breaches in 2025, Kroll report finds", 28 October 2026, https://www.helpnetsecurity.com/2026/10/28/kroll-third-party-data-breaches-insurance-claims-report/
2. Regulation (EU) 2016/679 (GDPR), Articles 5.1(c), 5.1(f) and 32, https://eur-lex.europa.eu/eli/reg/2016/679/oj
3. Cybersäkerhetslagen (2025:1506), implementing NIS2, entered into force 15 January 2026, https://data.riksdagen.se/dokument/sfs-2025-1506.html
4. WitniumChain documentation, https://witniumchain.com/docs