A vendor you use was breached: what a small company does next

When a vendor discloses a breach, first work out what data and credentials of yours they held. Then rotate every key and token connected to them, review your own logs for misuse, and decide whether customers need to be told. Do the rotation before the long reading of the vendor's statement.

Hour one: scope

Open your inventory and find the vendor. What data did you put in? What integrations connect it to your systems: API keys, OAuth grants, webhooks, SSO?

If you have no inventory, look at your identity provider app list and your source control and cloud integrations.

Hour two: rotate and cut

The FTC small business guidance on vendor breaches lists the steps: report to the authorities and industry regulators where relevant, confirm the vendor has fixed the vulnerability, consider cutting off access until it is resolved, check your own network for misuse and notify affected customers.

In practice, for a small team:

1. Rotate API keys and tokens the vendor held, starting with the most privileged.
2. Revoke and reissue OAuth grants.
3. Reset passwords of any shared accounts on the vendor's platform, and enforce MFA.
4. Pause the integration if it is not critical.

Day one: look for misuse

Review logs for activity linked to the vendor integration: unusual API calls, logins from new locations, new users or tokens, changes to permissions. Ask the vendor for indicators and the time window of the incident.

Note that the vendor's first statement is usually incomplete. Expect updates and re-check.

Decide about customer notice

If your customers' data sat with that vendor, you may have notice duties under your contracts or the laws that apply. The FTC guidance says to notify affected parties when customer or employee data is compromised. Contact whoever advises you on legal matters early rather than late.

Write clearly: what happened, what data, what you did, what customers should do.

Afterwards

Update the vendor record: data held, access scope, whether you still want them. A breach is a good reason to reduce what a vendor holds, or to test your exit plan.

Common pitfalls

Prepare in advance. Keep a list of the integrations each vendor holds, with where the keys are stored and who can rotate them, so that rotation takes minutes. Subscribe to vendors' status and security notices, and make sure the contact email on each account reaches more than one person. A vendor often notifies the account owner by email, and if that person left last year, the notice goes nowhere.

Afterwards, hold a short review: how quickly did you identify what the vendor held, and what slowed you down? Fix that gap while it is fresh.

Quick check

Sources

1. Cybersecurity for small business (FTC)

Last reviewed: 19 October 2026.