Supply chain incidents put you in an awkward position: responsible to your customers and regulators, but dependent on another organisation for facts, timing, and communication you do not control.

First: establish exposure

What data of yours did they hold, for how long, and in what form? This should come from your own records rather than from the vendor, because their initial statements are frequently incomplete and their scoping takes weeks. If you maintain a vendor access inventory, this is a five-minute question; without one it becomes a project at the worst possible moment.

Second: contain what you control

  • Revoke the vendor's access to your systems until the situation is understood.
  • Disable integrations, API keys, webhooks, and OAuth grants connecting them to you.
  • Rotate any credentials shared with them or stored in their platform.
  • Watch for phishing referencing the incident — attackers move quickly on public breaches.

Third: assess your own obligations

If personal data of your customers was involved, your obligations are triggered by that fact, not by whose systems failed. Under most regimes, if you are the controller and they are the processor, notification duties are yours. Clocks may start when you become aware, so record when you learned what.

Push the vendor for specifics

Ask for: what data was accessed or exfiltrated, the timeframe, the root cause, what has been remediated, and whether they will support your notification with written detail. Vague reassurance is not usable. Where your contract requires notification within a period or evidence of remediation, cite it — this is the moment those clauses exist for.

Communicate before it is public

If your customers are affected, telling them yourself is significantly better than them learning from a news article or the vendor's own disclosure. Explain what of theirs was involved, what you have done, and what they should do. Being the party that explained it clearly is the difference between a difficult week and lasting damage.

Afterwards, use it

Incidents at suppliers are the most persuasive argument you will ever have for the vendor access inventory, the offboarding discipline, and the contract terms that previously seemed like overhead. Do that review while the memory is fresh.