A software vendor sends you a data breach notice. Maybe it’s the company that runs your payroll, hosts your files, or provides the CRM your team uses every day. The email says the vendor is investigating and promises another update. You’re still left wondering whether your business was affected and what you need to do today.
The first notice may arrive while the vendor is still reviewing logs and figuring out which customers and systems were affected. Your team may need to review payments, secure accounts, alert employees, or contact your cyber insurer before the vendor has all the answers.
Start by verifying the notice and saving a copy. Then use the questions below to find out what happened and what your business needs to do next.
Verify the Data Breach Notice Before You Respond
A real breach can make a fake password reset email or support call more convincing. If a notice arrives unexpectedly, go straight to the vendor’s usual customer portal or call a representative using a number you already have. The UK National Cyber Security Centre recommends using contact details from the organization’s official website when you’re unsure about a message.
Once you’ve verified the notice, save the original email and any attachments so you can share them with your IT provider, insurer, or legal or privacy adviser as needed.
Find Out Whether the Vendor Breach Affected Your Business
A breach may be limited to one product, database, location, or group of accounts. Ask the vendor for answers specific to your company.
Were Our Accounts or Data Affected?
Ask whether the incident involved your company account, business information, or user data. If the vendor can’t give you a firm answer yet, ask whether it has confirmed an impact, identified a possible impact, ruled out an impact, or is still assessing your account.
If your account is still under review, ask when the vendor expects to know more and what precautions it recommends in the meantime.
When Did the Breach Start and What Could the Attacker Do?
Ask when the unauthorized activity began, when the vendor spotted it, and when it contained the affected systems. An estimated date range can help your IT team decide how far back to review sign-ins, file transfers, account changes, invoices, payment instructions, and messages.
Ask what the attacker could do during that window. Could they read, copy, change, or delete data? Could they create accounts, encrypt files, or contact customers through the platform? Access to a customer list might lead you to watch for phishing. Access to a connected system could warrant a broader review of account activity.
Which Types of Information Were Involved?
If the notice says “customer information” may have been exposed, ask the vendor to be specific. Did it involve contact details, payroll or payment records, identity documents, contracts, files, messages, or support tickets? Ask about usernames, password hashes, sign-in records, API keys, and access tokens, too.
Two companies can use the same software and face different risks. One may store only names and email addresses, while another uploads contracts, IDs, and invoices. Ask the vendor to identify the information tied to your account.
If the vendor says the data was encrypted, ask whether the attacker could also access the keys or a system that could decrypt it.
What Do the Logs Show About Access or Copying?
Ask whether the vendor can tell if someone opened or copied your data, or whether the investigation has only established that the data was on an affected system.
If the vendor reports finding no evidence of copying or misuse, ask which logs it reviewed, what activity those logs capture, and whether they cover the full incident window. A log that covers only part of that window leaves questions about what happened outside it.
Which Passwords, Keys, or Integrations Need Attention?
Ask whether the breach affected single sign-on, API keys, access tokens, security certificates, or integrations with systems such as email, accounting, payments, file storage, and backups. Find out which credentials the vendor recommends resetting, revoking, or replacing.
Have your IT team coordinate those changes so it can check what depends on each connection. Revoking a key without checking its dependencies could interrupt a payment process or stop files from syncing. If anyone reused a password from the affected service on another account, have them change it on every account where they used it.
What Has the Vendor Done to Secure the Service?
If the vendor says it contained the breach, ask what it did to stop the known activity. Did it disable compromised accounts, end active sessions, patch the software, rebuild affected servers, or replace exposed keys? Ask whether an independent security firm reviewed the incident and whether the vendor considers the service safe to use.
Find out which fixes are temporary and when the vendor expects to complete the remaining work. NIST’s incident response guidance describes how organizations and outside providers can share response responsibilities. While the vendor secures its platform, your business may still need to review account activity, protect connected systems, or assess its notification obligations.
What Does Our Business Need to Do Now?
Ask for written instructions specific to your account. The vendor might recommend installing an update, resetting accounts, reviewing activity logs, disconnecting an integration, or checking recent transactions. If it recommends an update, confirm which versions are affected, which version to install, and when the work is due.
Ask whether exposed information could make a follow-up scam more convincing. Someone who knows a real invoice number, the details of a support ticket, or the name of your vendor rep can write a believable message. If the vendor has spotted related phishing emails, fake websites, or fraudulent support calls, ask for examples you can share with your staff.
Did the Breach Involve One of the Vendor’s Providers?
Software vendors often use other companies for hosting, payment processing, email delivery, backups, or customer support. A provider that processes personal data on the vendor’s behalf may be a subprocessor.
If another company was involved, ask who it was, what service it provided, and what information it held. Find out whether it had direct access to your data or systems and whether your vendor still uses it.
Who Will Send Updates and When?
Ask for a named contact or incident response team so you have somewhere to take follow-up questions. Confirm where official updates will appear and when to expect the next one, even if the vendor is still investigating.
When the investigation wraps up, request a final report that explains what happened, how the breach occurred, which information was involved, and what the vendor changed afterward. Once the immediate response is over, review your vendor agreement for three things the National Cyber Security Centre recommends spelling out in its supply chain security guidance: how quickly the vendor must report an incident, who they should contact, and what each side is responsible for.
What Should We Keep in Our Incident Record?
Create a folder for the original notice, follow-up updates, your questions, and the vendor’s answers. Log what your business did and when, who approved key decisions, and what advice your IT provider, insurer, or legal adviser gave you. That gives everyone a shared record to work from if new details emerge.
The UK Information Commissioner’s Office advises organizations to document the breach, its effects, and the steps they took in response. Australia’s privacy regulator recommends containing the breach, assessing its impact, notifying as appropriate, and reviewing the response. Your obligations depend on where you operate, what data was involved, and how your business handles it.
Who Else Needs to Know About the Breach?
Depending on the incident, bring in your IT provider, legal or privacy adviser, cyber insurer, leadership, or communications team. You may also need to notify affected customers, employees, regulators, or other organizations.
If your cyber insurance may cover the incident, check the policy for notice deadlines and instructions on which legal, forensic, or incident response providers you can use. Contact your broker or insurer as the policy requires.
If personal information was involved, seek legal or privacy advice early. Notification duties can depend on the location, type of information, potential harm, vendor agreement, and whether your company decides how the data is used or processes it for someone else.
Under the GDPR, for example, a vendor acting as a data processor must notify the controller without undue delay after becoming aware of a personal data breach. The controller assesses whether it needs to notify regulators or affected individuals. The European Data Protection Board recommends that processors share additional information in stages as it becomes available. If your business needs help reviewing affected accounts or securing connected systems after a vendor breach, contact Twintel today.
Twintel has grown into an expansive, full team of IT services professionals, acting as the outsourced IT department of non-profits, small to mid-size businesses, and enterprise-level corporations in Orange County, across California, and nationally.
Today, it’s the strength and deep expertise of the Twintel team that drives positive outcomes for clients. Each of the support staff, technicians, and engineers works diligently each day to make sure that the companies served have the seamless, secure, and stable IT environments needed to allow them to pursue their organizational objectives.