Your vendor had an incident. What now?

Find what happened to your vendor, then follow the steps for that kind of record. This is general information, not legal or security advice.

The vendor filed a breach notice

A breach notice means the vendor told a state regulator that personal information was exposed. If you got a letter too, or your customers' or employees' data might be involved, read Your vendor had a data breach: what to do next. It covers what to do this week, whether you have to notify anyone, and the FTC Safeguards Rule.

A ransomware group claims it attacked the vendor

A claim on a leak site is not confirmed. Groups sometimes repost old data or make up victims. It's still worth a few minutes:

Check what the vendor says. Look at its status page, security page or news page, and the vendor's page here for a breach notice or SEC filing that would confirm it.
Ask the vendor in writing. Email your account contact: "We saw a ransomware claim naming your company. Was our data involved, and what should we do?" Keep their reply.
Change shared passwords and keys. Reset any password, API key or integration token your business uses with that vendor, and turn on two-step login if it isn't already on.
Watch for fake emails. Criminals use stolen data to send convincing phishing that looks like it comes from the vendor. Be careful with invoices, payment changes and login links in the coming weeks.
Write down what you did. The date, what you asked and what you changed. Insurers and auditors may ask how you oversee your vendors.

The vendor has a security flaw attackers are using

This is about the vendor's product, not a breach at the vendor. If you use the affected product, update it now or ask whoever manages your IT to. What a listing on CISA's list means.

Who can help

Your IT provider, if you have one, for updates, password resets and checking your systems.
Your cyber insurer, if you have a policy. Call its claims or breach line early. Your policy may require you to tell the insurer quickly.
A lawyer who handles data breaches, if your customers' or employees' personal information may be involved and you're unsure what you owe them.
For people whose identity was exposed: the FTC's IdentityTheft.gov.

We don't recommend or rank any provider, and no one can pay to be listed on this page.