Vendor breaches and cyber insurance: corporate liability and the ripple effect

When a data breach strikes, the public rarely pauses to ask: Was it really their fault? For many companies, the harsh light of scrutiny is turned on before the facts are fully understood, and increasingly, those facts involve a third-party vendor, not the company itself. Yet the reputational and regulatory damage lands all the same.

In a world of complex digital supply chains, businesses are now paying a steep price for risks they didn’t even know they’d outsourced.

Outsourced, Not Out of Mind

Let’s take the case of Marks & Spencer. News that the retailer could claim up to £100 million from its cyber insurance policy has reverberated across boardrooms. Not because it’s a singular event, but because it’s symptomatic of a broader trend: data breaches facilitated not by an organisation’s own failings, but by its partners.

The MOVEit breach, a vulnerability in widely used software, compromised the data of hundreds of organisations, many of whom had no direct relationship with the software vendor at all. Yet it is those companies, not the vendor, who are often expected to answer to regulators, clients, and the media.

The Legal Pinch Point

Legally, the buck still stops with the data controller. That means companies can’t point fingers at their suppliers and hope the regulator shrugs sympathetically. Under UK data protection law, businesses are expected to conduct due diligence, to monitor third-party risks, and to ensure contractual safeguards are in place.

The Interserve case is instructive here. Fined £4.4 million by the Information Commissioner’s Office, the company failed to prevent a cyber attack that compromised employee data. It wasn’t a matter of bad intent, but of bad preparation, and the courts, unsurprisingly, found that insufficient.

Insurers Enter the Frame

As the complexity of digital supply chains grows, so too does the scrutiny from insurers. Cyber insurance policies, once generous to a fault, are becoming leaner. Exclusions around third-party breaches are tightening. Claims, like that from M&S, are being examined with forensic intensity.

Premiums are also climbing, particularly for sectors reliant on high volumes of sensitive data or extensive third-party integrations. Businesses are learning that insurance is no longer a safety net. It’s a contract and one that increasingly demands proof of compliance, diligence, and foresight.

Best Practices for Mitigating Third-Party Cyber Risks

While third-party vendors enable agility and scale, they also introduce vulnerabilities that must be actively managed. These risks are not simply technical in nature, they sit at the intersection of compliance, liability, and reputational resilience.

To that end, businesses should adopt the following best practices:

Due Diligence Before Engagement

Assess the vendor’s breach history, security certifications, and subcontracting arrangements. This is your first, and often only, chance to vet their defences.

Risk-Based Tiering of Vendors

Classify vendors according to the sensitivity of the data they handle. Higher risk should trigger deeper scrutiny.

Cybersecurity Clauses in Contracts

Contracts must clearly define responsibilities, breach notification windows, audit rights, and indemnities. Legal clarity now prevents pain later.

Ongoing Monitoring

Tools such as SecurityScorecard or BitSight offer continuous insight into a vendor’s security posture. Don’t rely on annual questionnaires alone.

Governance and Ownership

Assign responsibility for third-party risk to a senior leader. Ensure regular board-level reporting and integration with broader risk frameworks.

Final Thought

The cyber threat landscape is no longer confined to a company’s own perimeter. Responsibility and risk now flow through its entire network of vendors and partners. The ripple effects of third-party breaches are real, and they are costly.

If your cybersecurity strategy ends at your firewall, then it ends too soon. It’s time to look beyond your own walls, because the law already does.

Third-Party Cyber Risk Mitigation Checklist

How Forbes Solicitors Can Help

Third-party data breaches raise serious legal and financial challenges, from regulatory scrutiny and contractual disputes to complex insurance claims. At Forbes Solicitors, we provide tailored, strategic advice to help organisations manage cyber risk across their supply chain and respond effectively when incidents occur.

Whether you’re defending an ICO investigation, navigating the fallout from a vendor breach, or seeking clarity on your cyber insurance coverage, our team can help. We work closely with clients to strengthen compliance, protect reputation, and reduce liability exposure.

Led by Craig MacKenzie, Partner and Head of our High-Profile & Private Crime Division, our team brings extensive experience in cybercrime, regulatory defence and complex digital investigations.

If your organisation needs expert support on third-party cyber risks or cyber insurance liability, contact Craig at [email protected] or call 01772 220022.