Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A company you trust may share information with outside providers that run payroll, host websites, answer customer calls, or process data. Those providers can become another place where information is stored or accessed—and potentially exposed. Their involvement alone does not mean your data was stolen. To understand a breach notice, look for which provider was involved, what information it could access, what was actually affected, and what steps you should take.
Why a familiar company may involve an unfamiliar provider
Businesses often rely on outside providers to perform everyday operations. A provider may handle payroll records, host a company website, operate a call center, or process information on the company’s behalf. Depending on the service, it may need access to personal information about customers or employees.
This creates a chain of custody: you give information to a familiar company, and that company may entrust some of it to a provider. The provider is an additional organization that may store or access the information, but outsourcing by itself is not evidence of a breach or misuse.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What a vendor breach does—and does not—tell you
A security incident involving a provider can vary in how it happened, what systems were reached, and what information was involved. A provider might hold a large amount of information without all of it being accessed or stolen. The number of records in a provider’s systems is not automatically the number of people affected by a confirmed theft.
#1 Best Overall
What the FTC’s InfoTrax example shows
In a 2019 account of the InfoTrax matter, the Federal Trade Commission said that approximately 11.8 million consumers’ personal information was stored by InfoTrax as of September 2016. That figure describes information held, not 11.8 million people whose data the FTC said was stolen. The distinction matters: a notice should tell you what was involved in the incident, rather than leave you to infer that every record on a provider’s systems was compromised.
The FTC also reported that one InfoTrax client received more than 280 alleged fraud reports after the incidents: 238 complaints about unauthorized credit-card charges, 34 about new credit lines, 15 about tax fraud, and one involving information misused for employment purposes. These were complaints described in the FTC account, not adjudicated or independently verified fraud findings. This single case is an example, not a measure of how often third-party breaches happen or how likely exposed people are to experience fraud. Read the FTC’s account of InfoTrax.
How to read a notice about a provider incident
When a company says a service provider was involved, the useful questions are specific. Look for answers in the notice, and contact the company through a channel you independently know to be legitimate if important details are missing.
- Which provider and service were involved? This helps explain why the provider had a relationship with the company.
- What information was involved? A notice should identify the categories of data, rather than imply that all information the company or provider holds was affected.
- What does the company say happened to that information? Distinguish information that was stored or potentially accessible from information the company says was actually accessed, acquired, or misused.
- What has been done? Look for steps taken to contain the incident, investigate the provider’s access, and address the problem.
- What should you do? Follow incident-specific guidance, such as watching for suspicious account activity or using any response resources the company offers.
The FTC’s breach-response guidance says notices should explain what happened, what information was involved, what steps have been taken, and what people can do. See the FTC’s data-breach response guide.
What companies can do to reduce provider risk
Consumers generally cannot inspect a company’s vendor contracts or independently verify a provider’s security. The controls below are business responsibilities, not a checklist that puts the burden on customers. The FTC’s guidance describes ways organizations can limit the risk created when they outsource work.
Before and during a provider relationship
- Investigate a provider’s security practices before entrusting it with information.
- Put security expectations in the contract and verify that the provider follows them.
- Give the provider only the data and access it needs, and limit how long that access lasts.
- Use encryption and require strong passwords and multifactor authentication for vendor access.
- Require prompt reporting of security incidents, including incidents where the provider has not yet confirmed that information was compromised.
The FTC’s small-business guidance discusses assessing providers and protecting information shared with them. Read the FTC’s guide to protecting personal information.
When an incident occurs
A company should investigate what information its providers could reach, review current access, and verify that claimed fixes have been made. It should identify the information and people affected, then notify appropriate businesses and individuals as required. A provider’s assurance that it fixed a problem is not a substitute for checking what access existed and whether remediation addressed it.
Why breach-notice rules depend on the information involved
There is no single notification rule that applies identically to every business, every type of information, and every incident. Duties depend on the data and the governing law, which can vary by jurisdiction.
For example, the FTC’s Health Breach Notification Rule applies to particular personal-health-record vendors, related entities, and third-party service providers. Under the FTC’s guidance, covered businesses must notify affected people and the FTC, and sometimes the media; covered service providers have duties to notify their clients. This specific health-record regime should not be treated as a universal rule for all companies or all data. Check the FTC’s Health Breach Notification Rule guidance.
What you can control as a customer
You cannot realistically audit every provider behind every company you use, and a breach notice may not reveal every technical detail. You can, however, use the notice to understand what information is at issue and act on its specific instructions. When a company offers practical steps or response services, assess them against the data identified in the notice rather than assuming every breach creates the same risk.
For your own accounts, multifactor authentication can add a protection against someone signing in with only a password. It does not prevent a provider from suffering a breach or undo exposure of information already held by a company or its provider.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
