Your vendor just emailed: 'We experienced a security incident.' Now what?

The email arrives on a Tuesday afternoon, from a vendor whose product your team uses daily. The subject line says “Important security update.” The body is 4 paragraphs of careful lawyer-reviewed language: an unauthorized party, a subset of customer data, an ongoing investigation, your security is our top priority. It names no dates, quantifies nothing and ends with a link to a FAQ that answers none of your questions.

Most businesses read that email, feel a vague unease and file it. That is the wrong move, not because panic is the right move, but because the email just started a clock. Whatever the vendor lost may include your credentials, your customer data or your employees’ information, and the attacker has been using the head start since before the email was written. A vendor breach is not your incident yet. The first 48 hours decide whether it becomes one.

Hour 1: figure out what the vendor actually holds

The response scales with the answer to one question: what of ours does this vendor have? Three buckets, in rising order of concern:

• Credentials and access. Do your people log into this vendor? Is it integrated into anything else, an API key in your accounting system, single sign-on, a connector into Microsoft 365? Vendor breaches become customer breaches most often through stolen credentials and tokens
• Your business data. What did you put in the tool? Customer records, financials, files, call recordings. If it is in the vendor’s cloud, assume the investigation’s “subset of customer data” could include it until told otherwise
• A path into your network. Does the vendor hold remote access to your systems, an agent on your machines or, for manufacturers, a connection into the plant? This is the bucket that converts a news story into an emergency, and it is why the vendor remote access inventory exists before the bad Tuesday

If you keep even a basic vendor inventory with data classifications, this hour takes 10 minutes. If you do not, this incident is the argument for building one, as laid out in vendor risk management for small business.

Hours 2 to 24: act on what you can control

You cannot investigate the vendor’s network. You can close the doors they may have leaked:

1. Rotate what the vendor touched. Passwords for the vendor’s product, any shared or service accounts tied to it, and every API key or token connecting it to your other systems. Tokens are the step people skip; a stolen integration token works long after passwords change
2. Force re-authentication if SSO is involved. Revoke active sessions for affected users. It is mildly annoying for the team and shuts out anyone riding a stolen session
3. Watch the blast radius. Tell whoever watches your alerts, in-house or your MDR, to flag logins and mail rules on accounts associated with the vendor’s users for the next few weeks. Attackers monetize breach data in waves, not all at once
4. Brief your people before the phish arrives. Breach lists become phishing lists within days, and the most effective lure will impersonate the breached vendor itself: “Due to the recent incident, please re-verify your account.” One short message to staff, this is happening, here is what the real vendor will and will not ask, blunts it

Day 2: the paper trail that protects you later

Two short documents, while details are fresh:

• A timeline note. When the vendor notified you, what they said, what you did and when. If the breach later touches your customers or triggers an insurance question, this contemporaneous record is worth far more than a reconstruction
• Questions to the vendor, in writing. What data categories were affected for your account specifically, when the intrusion began, whether credentials or tokens were taken, and what changed so it does not recur. Polite, specific and dated. The quality and speed of the answers tells you whether this vendor stays in next year’s stack, which is exactly the renewal-time judgment described in how to read a vendor’s SOC 2 report

Check your own obligations too. If the vendor held your customers’ data, your contracts with those customers may require notice from you regardless of what the vendor does. A 20-minute read of the 2 or 3 biggest customer agreements settles it, and your cyber insurer may want notice as well; many policies cover third-party incidents more gracefully when told early.

The posture that makes the bad Tuesday boring

Everything above runs in hours instead of days for companies that did 3 things in advance: kept a vendor list with what-data-do-they-hold noted, enforced MFA so a leaked password is not a skeleton key, and wired integrations with per-vendor accounts and keys so rotation is surgical instead of sweeping. None of those is a product to buy. They are habits, the same ones that show up in the incident response plan you run without an in-house team.

The vendors will keep getting breached. That part is not in your control. Whether their Tuesday becomes your quarter is.

Atticus Rowan handles vendor-breach response for clients as part of managed security, from the hour-1 triage through the letter that asks the vendor the pointed questions. If one of those careful 4-paragraph emails is sitting in your inbox right now, start a conversation today, not after the FAQ updates.