Tech Sector Supply Chain Breaches Drive 69% of Victim Data Exposure, Kroll Report Finds

The modern digital ecosystem is increasingly defined by complex, interconnected supply chains, a reality that has become a primary vector for cybercriminals seeking to maximize their reach. According to a new report from financial and risk advisory firm Kroll, this dependency on third-party providers has created a significant vulnerability for individuals and organizations alike. The research reveals that more than two-thirds (69%) of all data breach victims identified between June 2025 and June 2026 were affected specifically through third-party compromises.

The findings highlight a stark disparity between the frequency of attacks on specific industries and the resulting impact on individuals. While cybercriminals may target a variety of sectors for localized gains, the data suggests that breaches within the technology sector carry a disproportionately high risk of triggering a "domino effect," impacting massive numbers of downstream users who may have no direct relationship with the compromised software or service provider.

The Concentrated Impact of Technology Sector Breaches

The Kroll report, released on October 22, underscores that the technology sector serves as the primary engine for mass data exposure. Of the individuals who were victims of third-party breaches, an overwhelming 79% had their personal data accessed as a direct result of a compromise originating within a technology company.

To put this in perspective, the influence of the tech sector far outweighs that of other traditional industries. By comparison, third-party breaches emanating from the finance sector accounted for only 9% of victims, while insurance-related compromises contributed 6%, and healthcare-linked incidents were responsible for just 5%.

When looking at the total number of data breach victims over the 12-month period—including both incidents occurring at a single organization and those stemming from a supply chain breach—technology firms were responsible for 60% of the total impact. Other sectors followed significantly behind, with insurance accounting for 10%, finance for 8%, healthcare for 8%, and education for 7.5%.

The prevalence of these incidents is felt keenly by security leaders across the globe. Among those surveyed for the report, 69% confirmed that their own organizations had suffered at least one data breach during the previous year. Perhaps more concerning is that 34% of these leaders reported experiencing more than one breach in the same period, suggesting that the current defense landscape is struggling to keep pace with the evolving tactics of threat actors who prioritize high-leverage targets.

Finance and Professional Services Remain Primary Targets

Despite the outsized impact that technology companies have on the volume of compromised individuals, the industry itself is not the most frequently targeted sector in terms of the total number of incidents. In fact, technology ranked only seventh in the frequency of breaches observed by Kroll.

Instead, the financial sector and the professional services industry occupied the top positions, each accounting for 20% of the total number of breaches observed. Healthcare followed closely, representing 15% of incidents, while the retail sector accounted for 8%. By contrast, the technology sector represented only 6% of the raw number of data breach incidents, despite its massive contribution to the overall victim count.

This discrepancy between the number of incidents and the number of victims is a critical takeaway for risk managers and security analysts. It demonstrates that while hackers may focus their efforts on industries that hold highly sensitive financial or medical records—such as finance or healthcare—the strategic compromise of a single technology vendor can yield a much broader harvest of data. By targeting a provider that sits at the center of a software supply chain, threat actors can bypass the defenses of thousands of end-user organizations simultaneously, creating a scale of impact that individual attacks on specific firms rarely achieve.

The Mechanics of the Supply Chain Domino Effect

The researchers behind the Kroll report emphasized that the data paints a clear picture of the modern threat landscape: the appearance of susceptibility does not necessarily map to the highest-volume outcomes. Instead, the interconnectedness of business systems has allowed the technology sector to become a central nexus for data breaches.

Denyl Green, the global head of breach notification at Kroll, highlighted the systemic nature of these risks. "Across most of the major incidents we handled over the past year, a vendor, software supplier or service provider was the link between the initial breach and the organizations affected," Green noted. "One incident can reach businesses and individuals who have never dealt directly with the company where the compromise began."

This "link" is precisely what sophisticated threat actors are now weaponizing. By moving away from "smash-and-grab" attacks on individual companies, hackers are increasingly focusing on the IT service providers, cloud infrastructure managers, and software vendors that hold the keys to their customers’ digital environments.

The rise of advanced hacking collectives, such as the notorious "Scattered Spider," has brought this trend to the forefront of cybersecurity discourse. These groups have demonstrated a penchant for targeting IT service providers to gain privileged access to the downstream systems of those providers’ customers. By gaining entry to a trusted third party, attackers can effectively inherit the trust that the end-user has placed in that vendor, allowing them to move laterally and extract data with reduced friction.

The reality of these threats was further underscored in October 2026, when it was revealed that a Chinese nation-state actor had successfully gained access to the cloud infrastructure of ConnectWise, a prominent provider of IT management software. This breach provided the threat actors with a significant foothold, enabling them to potentially target a wide range of downstream customers who rely on ConnectWise’s tools to manage their own internal networks.

Strategic Implications for Security Leadership

As the data from the Kroll report makes clear, the security of an organization is no longer solely defined by its internal defenses. The reliance on external vendors, cloud services, and third-party software means that a company’s attack surface now extends far beyond its own physical or digital perimeter.

The fact that 69% of security leaders reported experiencing a breach in the past year, with a substantial portion suffering multiple incidents, indicates that the current approach to third-party risk management may be insufficient. The "domino effect" described by Kroll researchers serves as a stark reminder that in an interconnected economy, the weakest link in the supply chain often dictates the overall security posture of the entire network.

For many organizations, the path forward requires a shift in how they vet and monitor their technology partners. It is no longer enough to conduct an initial security assessment; organizations must maintain continuous visibility into the security practices of their vendors and have robust incident response plans that specifically account for supply chain failures. As threat actors continue to prioritize high-leverage points within the software and service ecosystem, the ability to rapidly detect and contain these third-party compromises will remain a defining challenge for security leaders in the coming years.

With the technology sector continuing to serve as both an essential backbone for business operations and a high-value target for adversaries, the data from the Kroll report reinforces the necessity for a more rigorous and collaborative approach to security across the entire digital supply chain.