Short answer
When a vendor gets hacked, your firm can be affected even if your own systems were never breached. Shared drives, subconsultants and software providers often hold your project files and client information. Verizon’s 2026 report found that breaches involving a third party now make up 48 percent of all breaches. Review who holds your data, what your contracts say and how your cyber policy treats third-party incidents. Coverage depends on the policy wording and the facts.
How common is it when a vendor gets hacked?
Verizon’s 2026 Data Breach Investigations Report found that third-party involvement now accounts for 48 percent of all breaches, up 60 percent, according to the report’s release.
That figure reflects how connected a modern firm is. Architects and engineers rely on cloud storage, project management tools, structural analysis software and outside consultants. Each connection gives an attacker another way in.
Which vendors and consultants could put your firm at risk?
Think about everyone who stores, receives or can reach your project data.
Shared drives and file-transfer tools. Many firms exchange drawings and models through cloud platforms. If the platform is breached, files you uploaded may be exposed.
Subconsultants. An MEP or geotechnical subconsultant may hold your drawings, site data and client contact details on its own systems. Its security practices may differ from yours.
Software vendors. Design, billing and email tools often run on the vendor’s servers. A vendor-side breach may involve your data without any action on your part.
Outsourced IT support. A managed IT provider may have broad access to your network. If that provider’s credentials are stolen, an attacker may reach your systems.
What happens to your firm when a vendor gets hacked?
You may learn about it from a notice, an email or a client. From that point, several questions tend to arrive at once. What data was involved? Does a contract require you to notify your client? Do you need to change passwords or revoke access?
Your own contracts matter here. A client may expect you to protect project information regardless of where it sits, including with your vendors. Read the confidentiality and data security sections to see what duties apply.
Your cyber policy may address some of these costs, but terms, exclusions and conditions vary. Check how the policy treats incidents at third parties and how it defines the events it covers.
Example: a subconsultant’s file server
A hypothetical architecture firm shares drawings with a structural subconsultant through a cloud folder. The subconsultant’s account is compromised, and an attacker downloads the project files, which include a client’s confidential floor plans.
The architect learns about it from the subconsultant. The firm now has to check its contract with the client, work out whether a notice is required and review its own cyber policy. It also needs to revisit its subconsultant agreement to see what security duties it contains.
Whether coverage applies depends on how the policy defines the incident and on the facts. The firm would need to read the actual wording.
What to check before a vendor gets hacked
- List the vendors and consultants who hold your files or can reach your systems.
- Check the data security and notification sections in your subconsultant agreements.
- Remove access for vendors and consultants once a project ends.
- Confirm that outside accounts use multi-factor authentication.
- Ask how your cyber policy treats incidents that start at a third party.
Our Cyber Liability page explains the main coverage areas. The cyber application shows the controls carriers ask about, including how you manage vendors.
Related questions
Am I responsible if a vendor gets hacked?
It depends on your contracts, the data involved and any laws that apply. Read your client agreements and your vendor terms to see what duties each one places on your firm.
Does cyber insurance cover a breach at a vendor?
Some policies address incidents at third parties in some form, but terms and conditions vary. Review the policy language, and ask your broker how it applies.
How can a small firm reduce vendor risk?
Start with a list of who holds your data. Then tighten access, use multi-factor authentication and review the security terms in your agreements.