Seven in ten people caught in last year's breaches were customers of a company that was never breached

Here is why the letter never makes sense. It arrives from a business you have never dealt with, telling you your date of birth and your address were in a file somebody took, and you spend ten minutes trying to work out whether it is itself a scam. Kroll's Data Breach Outlook 2026, published on 22 October, puts a number on how normal that has become: across the incidents its breach team handled from June 2025 to June 2026, 69 percent of the individuals affected were exposed through a supplier rather than through a company they had chosen.

Technology firms are where it concentrates. They came seventh by the number of organisations breached, and first by a long way in the number of people affected, accounting for 79 percent of all third-party breach victims. Finance managed 9 percent, insurance 6, healthcare 5. One payroll processor or one analytics provider getting hit reaches further than a hundred separate shop break-ins.

Denyl Green, who runs breach notification at Kroll, put it plainly: "One incident can reach businesses and individuals who have never dealt directly with the company where the compromise began." The companion survey of 250 leaders found 69 percent had been breached in the past year and 34 percent more than once.

None of this is something you can audit. What you can control is how far one leaked record travels, and that comes down to two habits: a different password on every account that matters, and knowing which email addresses of yours are floating around. Tendvane's Privacy and accounts check does the second part, looking up the addresses you give it against known breach collections so the next odd letter at least lands somewhere you recognise.