Your software supplier or agency had a data breach: what to do next

Give the notice an owner immediately

A supplier's message saying it has experienced a security incident may not tell you whether your customer information was accessed, what systems remain connected or what action your business needs to take. Record the notice and assign one internal person to coordinate the response. Use the supplier's verified support or security channel. Confirm an unexpected notice through a known route before following links, changing payment details or providing additional customer information. Keep the original message and relevant timestamps.

Keep readingReview your website incident-response process

Ask for the facts that affect your business

Request a dated account of what is known and what remains uncertain. Ask for updates on a defined contact route rather than forwarding fragmented messages around the team.

A supplier saying “no evidence of access” is not necessarily the same as establishing that access did not occur. Keep that distinction in internal and customer-facing language.

• Which of our accounts, records and data categories are affected, and during what period?
• Is unauthorised access continuing, and which containment actions have been taken?
• Were credentials, integration tokens, backups, attachments or logs involved?
• What evidence supports the assessment, and when will the next update be available?
• What actions do you require from us, and which contractual notification provisions apply?

Contain connections without destroying the record

Coordinate appropriate containment with the people responsible for the affected systems. That may involve restricting an integration or rotating an exposed credential, but the right action depends on what has happened. Preserve logs and other evidence needed for investigation before making changes that remove them. OAIC guidance organises breach response into containment, assessment, notification and review. Those steps can overlap. A pre-agreed incident process is useful, but do not tick a box as complete while the relevant facts or protections remain unknown.

Assess your own responsibilities

The Notifiable Data Breaches scheme applies to certain entities and eligible breaches, including the serious-harm threshold and other conditions explained by the OAIC. A supplier's incident does not automatically mean every customer must be notified, or that your organisation has no role. Establish which entity holds the affected information, the applicable obligations, the assessment process and who will coordinate any required notifications. Get appropriate privacy or incident-response help for that assessment when needed. Do not assume the supplier's broad public announcement fulfils every responsibility your business may have.

Worked example: an agency's connected account

Imagine an agency reports that one of its connected tools was compromised. Your business asks whether its account was involved, which access tokens were affected and what customer information the tool could reach. The administrator checks the actual connection scope instead of assuming it only held ad statistics. The internal owner records the supplier's answer, checks relevant business logs, coordinates any required access changes and keeps unresolved facts in the incident record. A reassuring headline from the supplier is useful context, not a substitute for that account-specific assessment.

Keep readingCheck what the contract says about data

Review the relationship after the immediate response

Record the outcome, any continuing uncertainty, control changes and the person responsible for follow-up. Revisit connection permissions, data minimisation, notification contacts, retention and contract-exit arrangements. Keep the response record in an appropriate restricted location. The final improvement should address the exposure revealed by the incident, rather than merely replacing a password and declaring everything resolved without evidence.