Your vendor had a data breach. What should you do?

Updated Oct 26, 2026

If a company your business uses tells you it had a data breach, first find out whose data was involved: yours, your customers' or your employees'. Then change the vendor's access, ask what it fixed, and check whether you have to tell anyone. In California and Washington, a company that holds data for someone else must tell the owner right away. The owner then generally has 30 days to notify the people affected.

First, figure out which kind of letter you got

Breach letters from vendors come in two kinds, and they mean different things for you.

Your own information was involved. The vendor is writing to you as one of the people affected, for example as an account holder.
Information you gave the vendor was involved. The vendor held data about your customers or employees for you, the way a payroll or billing company does. In California and Washington, a company that keeps data it doesn't own must tell the owner as soon as it finds the breach (California Civil Code 1798.82(b), RCW 19.255.010(2)). If you're the owner, you may be the one who has to notify those people.

A letter sent under California law has to be titled "Notice of Data Breach" and use five headings: What Happened?, What Information Was Involved?, What We Are Doing, What You Can Do, and For More Information (Civil Code 1798.82(d)(1)). Many companies use this layout in every state. Read the second heading first.

What to do this week

Checklist for the week after a vendor reports a data breach. 1. Save the letter and note which data and dates it lists. 2. Check it's real: go to the vendor's site yourself, don't click links in the message. 3. Change passwords and cut access the vendor doesn't need. 4. Ask the vendor what happened and what it fixed. 5. Check whether you must notify anyone. 6. Call your cyber insurer or lawyer if your customers' or employees' data was involved.

Save the letter. Write down what data it lists and the dates. You'll need both if you have to notify anyone.
Check that it's real. Scammers copy breach news. Don't click links or call numbers in the message. Go to the vendor's website yourself, or call a number you already have.
Change passwords and cut access. The FTC's guide for businesses says to "update credentials and passwords of authorized users." It also says that if service providers were involved, look at what personal information they can reach and decide whether that access needs to change (FTC, Data Breach Response: A Guide for Business). Turn on two-step login for the vendor's account if it offers it.
Ask the vendor questions. What happened? Which of your data was involved? What did they fix? The FTC suggests checking that a provider really fixed the problem, not just taking its word for it.
Check whether you have to notify anyone. See the next section.
Call your cyber insurer or a lawyer if your customers' or employees' data was involved. Your policy may set a deadline for telling the insurer.

Do you have to notify anyone?

It depends on whose data it was and where those people live, because every state has its own breach law (NCSL list). Two examples:

California: the business that owns or licenses the data must notify affected California residents within 30 calendar days of finding out about the breach, with some exceptions, like a police request to wait. If more than 500 California residents get a notice, the business must also send a sample copy to the Attorney General within 15 days of notifying them (Civil Code 1798.82(a) and (f)).
Washington: people must be notified no more than 30 calendar days after the breach was discovered, with some exceptions. If more than 500 Washington residents are notified, the Attorney General must be told within the same 30 days (RCW 19.255.010(7) and (8)).

Some businesses also answer to a federal rule. Tax preparers, mortgage brokers and other businesses covered by the FTC Safeguards Rule must tell the FTC within 30 days of finding a "notification event" that involves the information of at least 500 consumers (16 CFR 314.4(j)). Whether a vendor's breach counts for you is a question for a lawyer.

This is general information, not legal advice. Breach laws differ by state and change often. If your customers' or employees' data was involved, talk to a lawyer or your insurer soon, because the clocks above are short.

Look up the vendor's public record

A breach letter tells you about one incident. It helps to know if the vendor has a history. Vendor History tracks 112 vendors small businesses use. For each one it lists breach notices filed with the California and Washington Attorneys General, cyber incident filings with the SEC (Form 8-K, Item 1.05) and flaws on CISA's list of exploited security flaws. Every entry links to its source.

For example, Change Healthcare's page shows a breach notice filed with the Washington Attorney General on Aug 3, 2024 that lists the cause as a ransomware attack and 3,121,209 Washington residents affected (Washington record), the same day's notice to the California Attorney General, and three SEC filings by its parent company, UnitedHealth Group, starting Feb 22, 2024 (first filing).

Search all 112 vendors. If a vendor's page is empty, it means we found nothing in those sources. It doesn't mean nothing happened. Some breaches are only reported to other states, and some are never reported.

If the FTC Safeguards Rule covers your business

The Safeguards Rule applies to many small financial businesses, including tax preparation firms and mortgage brokers (FTC, Safeguards Rule: What Your Business Needs to Know). It says you must oversee your service providers by picking ones that can protect customer information, requiring that in your contracts, and checking on them from time to time based on the risk they pose (16 CFR 314.4(f)). A breach letter from one of them is a good moment to do that check and write down what you found.