When the Breach Notice Comes From a Vendor: The First Five Questions

The email arrives with a careful subject line: 'Important security update.' A vendor you rely on has had an incident. The notice is long on concern and short on facts, and it ends with a promise to share more 'as the investigation progresses.'

Your exposure clock started when their attackers got in, not when the vendor sent the email. What you do in the first days determines whether you get ahead of your own customers' questions or spend weeks reconstructing basics.

Five questions, asked immediately and in writing, turn a vague notice into a working picture.

TLDR

• Ask in writing; verbal answers evaporate and legal review slows everything later.

• First establish whether your data or your operations are actually in scope.

• Get dates: when it started, when they knew, when you were told.

• Ask what they need from you - log retention, contact routing, evidence preservation.

• Start your own internal log the day the notice arrives.

1. Are our data or systems in scope?

Everything else hangs on this. Ask specifically: which of your data categories, which integrations, which credentials or connections. Vendors often answer in general terms; press for the scope statement that names what was affected and, just as important, what they have ruled out.

A 'we have no evidence your data was accessed' is a starting point, not a conclusion. Ask what the statement is based on and when they will know more.

2. What are the dates?

Three dates shape your response: when the incident began, when the vendor detected it, and when they notified you. The gaps between them tell you how mature their detection is and how much catch-up you are playing.

Dates also feed your own assessment of what obligations you may have. Keep them in your incident log verbatim, with the source email preserved.

3. What are they doing, and what do they need from you?

Ask what containment and investigation steps are underway, who is leading them, and what the vendor needs from your side: log retention, a technical contact, preservation of integration records, or a temporary suspension of an API connection.

Vendors sometimes need you to act - rotate a shared credential, review access logs - and bury the request in paragraph nine. Ask directly so nothing is missed.

4. Who is our named contact, and how often will we hear from them?

Incidents run for weeks. Establish a named contact, a cadence for updates, and a channel that works if their email is the thing that is compromised. This fictional example shows a tracking entry. It is an illustration, not a real record.

Item	Detail
Vendor contact	Name, role, direct email and phone
Update cadence	Every Tuesday and on material change
Our internal owner	Named person tracking the response
Next milestone	Forensics scope statement due date

5. What should we tell our own stakeholders?

Ask what the vendor is telling other customers and the public, and whether they object to you describing the incident to your customers if asked. Aligning early prevents the awkward situation where your customers know more from the news than from you.

Internally, brief the people who will get questions: support, sales, and whoever owns the customer relationships most exposed. A holding line agreed now beats improvisation later.

The related discussion of third-party risk reporting to the board is worth your time alongside this one.

Frequently asked questions

What if the vendor goes quiet?

Escalate commercially: the account executive, the contract's notice provisions, and your executive sponsor at the vendor. Silence during an active incident is itself information about their maturity, and it belongs in the vendor file.

Should we suspend the integration immediately?

Only if the scope statement suggests live exposure, or the vendor asks. Indiscriminate shutdowns cost operations and may destroy evidence. Decide on facts, and record who decided and why.

When do we involve counsel or our insurer?

Early, if your data may be in scope or your own notification duties could be triggered. That is a judgment for your leadership and advisors; the five questions exist to give them facts fast.

A Defensible Next Step

Save a one-page template with these five questions where your team can find it in the first hour. The next vendor notice will not wait for you to draft them. Book a Decision-Clarity Call if you want the template built for your vendor stack.