You’ve received a data breach notice from a software vendor your business relies on, perhaps your payroll provider, accounting platform, CRM, or cloud storage service.

The notice may say an incident occurred and an investigation is underway, but it may not answer the most important question: What does this mean for your business?

Early breach notices often arrive before the investigation is complete. You may still need to reset accounts, review transactions, alert employees, or contact your insurer before the vendor has every answer.

You don’t have to wait for the final report. Start by confirming the notice is legitimate, saving a copy, and finding out exactly how your business may be affected.

First, Make Sure the Notice Is Genuine

Criminals can take advantage of real breach announcements by sending fake password-reset messages or pretending to provide support.

Before clicking links or calling numbers in the breach notice, verify it through a trusted source. Visit the vendor’s website yourself, use your normal customer portal, or contact a representative using details you already have.

The UK National Cyber Security Centre recommends contacting organizations using details from their official website when you are unsure whether a message is legitimate.

Once confirmed, save the notice and any attachments. Your IT provider, insurer, legal adviser, or privacy contact may need them.

Find Out Whether Your Business Was Affected

A breach does not necessarily affect every customer. Ask the vendor whether your company, accounts, or data were:

  • Confirmed to be affected
  • Possibly affected
  • Confirmed not to be affected
  • Still under investigation

If the answer is still unknown, ask when more information will be available and whether you should take precautions now.

Ask What Happened and When

Find out when the unauthorized activity began, when it was discovered, and when the affected systems were contained.

These dates can help your IT provider determine how far back to review your own activity.

Also ask what the attacker could actually do. Were they able to view, copy, change, or delete information? Did they gain access to accounts, credentials, files, or systems connected to your business?

Find Out What Information Was Involved

“Customer information may have been affected” isn’t specific enough.

Ask exactly what information connected to your business was involved. Depending on the service, that could include:

  • Employee or customer information
  • Payroll or payment records
  • Contracts and files
  • Usernames or password information
  • Messages and support tickets
  • API keys, access tokens, or other credentials

If the vendor says the data was encrypted, ask whether anything needed to decrypt that information was also affected.

Also ask whether the information was actually accessed or copied, or whether it was simply stored on an affected system.

If the vendor says there is “no evidence” your data was misused, ask what logs or other records support that conclusion and whether they cover the full period under investigation.

Check Passwords and Connected Systems

Passwords may only be part of the issue. Business applications often connect to other systems using single sign-on, API keys, access tokens, certificates, and integrations.

Ask whether any connected systems or credentials were affected and which ones need to be reset, revoked, or replaced.

Let your IT provider coordinate these changes where possible. Removing the wrong connection can interrupt important business systems.

If an employee reused a password from the affected service elsewhere, change it on those accounts too.

Ask What the Vendor Has Done

If the vendor says the incident has been contained, ask what that means.

Find out whether it has:

  • Disabled compromised accounts
  • Revoked sessions or access keys
  • Patched vulnerable systems
  • Rebuilt affected systems
  • Brought in an outside security company
  • Determined that the service is safe to use

Also ask what security work remains and whether any temporary fixes still need to be replaced with permanent ones.

NIST’s incident-response guidance can provide additional information about preparing for and responding to cybersecurity incidents.

Find Out What Your Business Needs to Do

Ask the vendor for written, customer-specific instructions.

Actions might include updating software, resetting accounts, reviewing logs, replacing credentials, checking transactions, or temporarily removing an integration.

Also consider related phishing attacks. Information exposed in a breach could potentially be used to make fraudulent messages seem more believable. Ask whether the vendor has identified related fake emails, websites, or support calls that employees should watch for.

Ask Whether Another Provider Was Involved

Your software vendor may use other companies for hosting, payments, email, backups, or customer support.

If another provider was involved in the breach, ask:

  • Which company was affected?
  • What service did it provide?
  • What information did it have?
  • Did it have access to your business’s data or systems?
  • Is your vendor still using that provider?

This can help you understand how far the incident extends beyond the primary vendor.

Get a Contact and Keep Receiving Updates

Ask for a named contact or incident-response team rather than relying solely on a general support inbox.

Confirm where official updates will appear and request a final report when the investigation is complete.

The NCSC’s supplier security guidance can also help businesses consider incident reporting, contacts, and supplier responsibilities.

Keep Records of Your Response

Create a folder for the incident and keep:

  • The original notice and attachments
  • Subsequent vendor updates
  • Your questions and the vendor’s answers
  • Actions your business took
  • Important decisions and approvals
  • Advice received from your IT, insurance, privacy, or legal professionals

Privacy and breach-reporting obligations vary depending on where your business operates, the information involved, and your role in handling it. If personal or sensitive information may have been affected, get appropriate legal or privacy guidance.

Decide Who Else Needs to Be Involved

Depending on the incident, you may need to involve your:

  • IT provider
  • Cyber insurer
  • Legal or privacy adviser
  • Senior management
  • Communications team

Customers, employees, regulators, or other organizations may also need to be notified depending on the circumstances and applicable requirements.

If you have cyber insurance, review your policy and follow its notification requirements. Some policies may specify which legal, forensic, or incident-response providers should be used.

Frequently Asked Questions

What if the vendor says there is no evidence our information was misused?

Ask what logs or evidence support that conclusion, whether they cover the entire affected period, and whether the investigation is complete.

Should everyone change their password immediately?

Follow the vendor’s instructions and work with your IT provider to determine which accounts need attention. Any password that was reused elsewhere should also be changed.

Your IT provider should also determine whether sessions, API keys, access tokens, or other credentials need to be revoked.

Does a vendor breach mean we must notify our customers?

Not always. It depends on whether your business was affected, what information was involved, applicable laws, your contracts, and where affected people are located. Seek appropriate legal or privacy advice before making that decision.

Should we stop using the vendor?

Not necessarily. Consider what happened, what information was affected, how the vendor responded, and whether the underlying security problem has been addressed.

Communication matters too. If the vendor cannot provide reasonable answers about the incident or how it secured the service afterward, that should factor into your decision.

Sources and Further Reading

If a software vendor has reported a breach and you’re unsure what it means for your business, talk to your IT provider. If you don’t have one, reach out to Takala Technology and we’ll help you understand the risk, determine what needs to be checked, and work through your next steps.