The email arrives: one of your vendors has experienced a “security incident.” They’re “investigating” and will “keep you updated.”

Your data might be compromised, and you have no idea what to do next.

It happens more than you’d think. Supply chain breaches are increasingly common, and every business relies on vendors who hold their data. Let me walk you through how to respond.

The First 24 Hours

1. Don’t panic, but do act.

The notification you received is often vague - vendors don’t always know the full scope initially, and legal teams tend to water down communications. That vagueness isn’t a reason to ignore it.

2. Read the notification carefully.

Look for:

• What data may have been accessed?
• What timeframe does the breach cover?
• What is the vendor doing about it?
• Is there anything you need to do?
• Contact information for questions

Save the notification. Screenshot it if it was delivered through a portal. You’ll need this for documentation and potentially insurance claims.

3. Identify your exposure.

What data did this vendor have access to?

• Customer personal information?
• Financial data?
• Employee records?
• Business-sensitive information?
• Access credentials to your systems?

If you don’t know, that’s a problem for after the immediate response - but it highlights why vendor data inventories matter.

4. Change shared credentials immediately.

If the vendor had any credentials for your systems - API keys, login accounts, shared passwords - change them now. Don’t wait to find out if they were compromised.

5. Alert your team.

Relevant people need to know:

• IT/security to monitor for suspicious activity
• Legal for potential notification obligations
• Leadership for decision-making
• Customer service if clients might ask questions

Assessing the Impact

Once the initial scramble is over, you need to understand what this means for your business.

Request more information from the vendor.

Their initial notification probably left questions. Ask:

• Was our specific data accessed, or is it a general possibility?
• What exactly was exposed (names? emails? financial data?)
• How long did attackers have access?
• How did the breach occur?
• What remediation are they undertaking?
• Will they provide credit monitoring or other services to affected individuals?

Document these communications. A vendor’s promises during a breach may become relevant later.

Review your data inventory.

What data did you actually share with this vendor? Check:

• Initial onboarding and setup
• Ongoing data feeds and integrations
• Any one-off data shares
• Configuration information
• Access credentials

Assess your downstream obligations.

If the vendor’s breach exposed your customers’ or employees’ personal information, you may have your own notification obligations under the Privacy Act’s Notifiable Data Breaches scheme.

Key questions:

• Was personal information involved?
• Would a reasonable person consider this likely to cause serious harm?
• Can you mitigate the harm through your own actions?

When in doubt, consult your lawyer. The OAIC provides guidance, but legal advice for your specific situation is valuable.

Communicating With Your Stakeholders

Your customers:

If their data may have been exposed, they deserve to know. Even if you’re not legally required to notify, consider:

• Is there anything they should do (change passwords, monitor accounts)?
• Would they expect to be told?
• What would the reputational impact be if they found out later you knew and didn’t tell them?

Be honest about what happened and what you’re doing. Trying to minimise or hide breaches usually backfires.

Your employees:

If employee data was involved, the same principles apply. They need to know, and they need to know what to watch for.

Your board or leadership:

They need a clear summary:

• What happened
• What’s the potential impact
• What are we doing about it
• What decisions do we need to make

Your insurers:

If you have cyber insurance, check the policy for notification requirements. Many policies require prompt notification of potential claims. Failing to notify might affect your coverage.

Longer-Term Actions

Monitor for misuse.

The weeks and months after a breach disclosure are when stolen data gets used. Watch for:

• Suspicious login attempts
• Phishing campaigns targeting your organisation
• Unusual activity in any systems the vendor could access
• Reports from customers of fraud or impersonation

Review the vendor relationship.

Hard questions:

• Should we continue working with this vendor?
• What security assurances did they give us, and did they meet them?
• Do we have contractual rights or remedies?
• What would it cost to switch?

You might decide to stay - breaches happen to everyone. But this is an opportunity to reassess.

Update your vendor management practices.

Use this incident to improve:

• Do you have a data inventory for each vendor?
• Do contracts include security requirements and breach notification terms?
• Do you conduct security assessments of vendors?
• Do you have a response plan for vendor breaches?

Document everything.

For insurance, for compliance, for potential legal proceedings - keep records of:

• The vendor’s notifications and your requests for information
• Your internal actions and decisions
• Communications with affected parties
• Costs incurred (staff time, tools, legal fees, etc.)

The Vendor Management Piece

This is the moment to think about how you manage vendor security generally.

Before engaging vendors:

• Security questionnaires or assessments
• Clear contractual requirements
• Understanding of what data they’ll access
• Review of their incident response commitments

During the relationship:

• Regular security reviews
• Updated data inventories
• Monitoring for issues or news about vendor breaches

Contractual protections:

• Security commitments and standards
• Breach notification timeframes (24-48 hours, not “promptly”)
• Audit rights
• Liability and indemnification provisions

None of this prevents breaches completely. But it ensures you know your exposure and have some recourse when things go wrong.

The Silver Lining

Every vendor breach is an opportunity. It’s a chance to:

• Test your incident response capabilities
• Identify gaps in your vendor management
• Build relationships with legal and insurance contacts
• Improve your own practices

It’s also a teachable moment for leadership. The next time you’re asking for budget for security improvements, you’ve got a concrete, close-to-home example of why it matters.

Vendor breaches are going to keep happening. The question is whether you’re prepared when they hit your supply chain.