If a vendor breach may affect your customers, tell them yourself, using facts you have verified for your own data, and name what you are doing about it. Do not forward the vendor's wording. Your customers trusted you, not your supplier, and many legal duties stay with you as the party that holds the relationship.
First, work out your exposure
Before writing anything, answer these internally.
- What data of yours or your customers' did that vendor hold or touch?
- For what period, and in which systems?
- Which credentials or tokens did you give them, and have you rotated them?
- What does your contract say about notice timing? See vendor breach notification clauses.
The first-48-hours steps are in your security vendor was breached.
Decide whether customers must be told
Consider legal duties where you operate and where your customers are, contract terms and the likely harm. When unsure, ask counsel early. Waiting for the vendor to finish its own investigation can cost days you do not have.
What the message should contain
- That a supplier you use had a security incident, and the vendor's role by function. Naming the vendor is a decision for you and legal, and customers may need it to assess their own exposure.
- What it means for them: affected, not affected based on your review, or still being determined.
- What you have done: rotated keys, restricted access, paused the integration.
- What they should do, if anything.
- When you will update them.
Words to avoid
"Our vendor is solely responsible." You chose, and are accountable for, your supply chain. Blame invites follow up questions about your vendor management.
Evidence for later
Keep your vendor risk records, notices received, the time you learned and each step you took. They show diligence to customers and regulators.
Reduce the next one
Keep an inventory of vendors with the data and credentials each can reach, tier them by risk, and give contacts for each. When a notice arrives, you will know in minutes who is affected.
Quick check
Should we wait for the vendor's final report?
No. Send what you have verified, say what is pending, and update.
Do we name the vendor?
Decide with legal. Customers often need the name to evaluate their own risk.
Last reviewed: 19 October 2026.
