Key Takeaways

  • Reported U.S. breaches affected at least 343 million people in the first half of 2026.
  • Third-party exposure is expanding the potential impact of individual security failures.
  • Zero Trust and stronger cybersecurity governance can help companies contain credential abuse and ransomware.

Data breaches have become a routine operating risk rather than an occasional crisis. Privacy Rights Clearinghouse recorded 1,969 reported events affecting at least 343 million people in the first half of 2026. Hacking accounted for 58% of those incidents, reinforcing the extent to which external attacks remain a central concern for security teams.

The pace follows an already active 2025. According to the Privacy Rights Clearinghouse, 4,080 distinct U.S. breach events affected at least 375 million people during that year. The totals do not mean that every affected person was unique, since individuals can appear in multiple incidents, but they still demonstrate the scale of data exposure facing businesses and consumers.

Ransomware remains part of that picture. Source material reviewing 12,195 breaches found ransomware present in 44% of them. In some cases, stolen information may also have been released or offered through an online marketplace, adding extortion, fraud, and reputational damage to the disruption caused by encrypted systems.

An organization does not have to be the original intrusion target to bear the consequences.

Kroll found that third-party breaches accounted for 69% of affected individuals in its case data covering June 2025 through June 2026. Technology-sector breaches accounted for 60% of all individuals affected in the same dataset. Financial services represented 20% of the breaches Kroll handled, tying professional services for the highest sector share.

Those findings point to a structural issue. Enterprises rely on cloud applications, identity providers, managed services, software integrations, and data processors. Each relationship can introduce credentials, application programming interfaces, or data flows that need oversight. A compromise at one widely connected provider can therefore travel far beyond the provider's own environment.

The business question is no longer limited to whether a supplier has security certifications. Companies also need to understand what information the supplier holds, which systems it can access, how quickly that access can be revoked, and whether incident notifications arrive soon enough to support containment. Organizations must be able to answer these questions for every critical vendor to maintain security.

Identity platforms such as Okta and Microsoft Entra ID illustrate the growing emphasis on controlling credentials and access. CrowdStrike, meanwhile, represents the endpoint detection and response layer used to identify suspicious behavior across devices and workloads. These products address different parts of the problem, and deploying one does not remove the need for the others.

Technology selection represents only part of the necessary response. NIST Cybersecurity Framework 2.0 added "Govern" to its six core functions, placing greater emphasis on leadership, policy, responsibilities, and risk oversight. The NIST guidance complements NIST SP 800-207, Zero Trust Architecture, which advocates continuous verification instead of granting implicit trust based on network location.

Applying these frameworks requires implementing phishing-resistant authentication for sensitive accounts, limiting administrative privileges, segmenting important systems, and assessing each access request using identity, device, and contextual signals. Shorter credential lifetimes and tighter controls over service accounts can also reduce the time available for attackers to move through an environment.

Procurement teams may approve suppliers, security teams may monitor technical controls, and legal teams may negotiate breach terms, but fragmented ownership can leave nobody responsible for the complete third-party risk picture. NIST's added Govern function gives boards and executives a useful prompt to clarify accountability before an incident tests it.

Organizations can also prepare for operational resilience. Accurate asset inventories, tested backups, rehearsed incident-response procedures, and established communication channels matter when systems are under pressure. Security teams must also verify which outside parties can reach critical data.

Recent breach figures suggest that planning should be treated much like financial control. Companies may not prevent every intrusion, especially when suppliers are involved. They can, however, reduce standing access, detect abnormal activity earlier, and limit how far one compromised identity or vendor connection can reach.