Your Vendors Have Keys to Your Data. Time to Count Them.

The keys you handed out and forgot

Think about every outside company that touches your data. The payroll provider. The billing software. The cloud data warehouse. The managed IT firm with remote access to your servers. The marketing tool someone connected to your customer list two years ago.

Each one either stores a copy of your data or holds a login that reaches it. Ask three people in your company to list them and you will likely get three different lists. The controller knows who gets paid. IT knows who has remote access. The sales team knows which apps they connected last spring. Nobody has the whole picture, and that gap is where a lot of breaches now start.

What the evidence says

Verizon published its 2026 Data Breach Investigations Report on May 19, 2026. It looked at more than 31,000 security incidents and more than 22,000 confirmed breaches. Third party involvement reached 48 percent of breaches, up from 30 percent the year before. Verizon describes that as a 60 percent increase.

Smaller companies are hit harder. Verizon counts any organization with fewer than 1,000 employees as a small business. Across 7,152 small business breaches in the report, a third party was involved in 55 percent.

Problems on the vendor side also stay open a long time. Verizon tracked weak spots in vendors' cloud accounts. Half of the missing or weak multifactor login findings were fixed within about a month. Only about 23 percent of the vendor organizations fixed them fully. Weak passwords and excess permissions were slower. It took almost eight months to fix half of those findings, and 31 percent were fully fixed.

The report sorts vendor breaches into three kinds. A flaw or back door in software you buy. A vendor that hosts your data and gets breached, or whose login to your account gets stolen. A vendor connected to your network that becomes the way in. Verizon cites public examples for each, including SolarWinds, the Snowflake account campaign and the Target breach. It also describes a recent campaign where stolen tokens from the Salesloft Drift app were used to pull customer data out of Salesforce.

Why vendor access gets out of hand

Verizon's own read is that many of the vendor cloud breaches in the news came down to weak logins and too much access. Missing multifactor sign in, old credentials that were never rotated, and users or service accounts with more rights than they need. Those are habits, and habits can change.

Nobody owns the list

IT signs some contracts. Finance signs others. Sales and marketing connect apps on their own with a company card. No single person sees every vendor that holds company data, so nobody can say when one should be cut off. When a vendor announces a breach, the first hour is spent figuring out whether you even use them.

Access outlives the work

A consultant gets a login for a three month project. The project ends and the account stays. An integration token is created for a test and never removed. A former vendor still has a saved password to your file share. These quiet leftovers are easy for an attacker to use and hard for you to spot, because nobody is watching accounts that nobody remembers.

Connected apps ask for everything

When someone links a new tool to your email, file storage or customer system, the default request is often full read access. People click approve to get the tool working. That one click can give an outside company standing access to far more data than the job needs.

Contracts say little about data

Many vendor agreements cover price and uptime but stay quiet on data. They do not say how fast the vendor must tell you about a breach, what happens to your data when the contract ends, or whether the vendor's own subcontractors can see it.

A practical vendor access review

1. 1Build one list of every vendor that stores your data or can log in to your systems. Pull it from accounts payable, your single sign on tool and your connected app settings, not from memory.
2. 2Write down what each vendor holds or can reach. Note whether it includes customer, employee or financial data.
3. 3Name one owner inside your company for each vendor. That person approves access and answers for it.
4. 4Turn on multifactor sign in for every vendor and contractor account, starting with admin accounts.
5. 5Cut permissions down to what the work needs. Remove full access grants from connected apps where a smaller scope will do.
6. 6Close accounts and revoke tokens the day a project or contract ends. Check again every quarter for anything missed.
7. 7Add data terms to new and renewing contracts. Cover breach notice timing, deleting or returning your data at the end, and rules for the vendor's own subcontractors.

Start with the vendors that hold the most sensitive data. A first pass on your top ten can take days rather than months. Expect to find a few accounts nobody can explain. That is normal, and finding them is the point. Once the list exists, keep it in one shared place and update it whenever a contract is signed or ended.

What this means if you run a company in Oklahoma

Oklahoma law now speaks to vendors directly. Senate Bill 626 took effect January 1, 2026. It says a business that holds personal information it does not own must tell the owner of that information about a breach as soon as practicable after it determines one happened. If 500 or more Oklahoma residents are affected, the owner must also notify the Attorney General within 60 days of notifying residents. Your vendor's notice to you starts your clock.

Senate Bill 546, the state's new consumer data privacy law, takes effect January 1, 2027. It applies to businesses that handle personal data of at least 100,000 consumers in a year, or at least 25,000 consumers if more than half of revenue comes from selling personal data. For those businesses, the contract with each data processor must set out instructions, the type of data and how long it is processed. The processor must keep the data confidential, delete or return it when the service ends, allow reasonable assessments and hold its own subcontractors to the same terms in writing.

Even if your company falls below those lines, the contract terms are a sound baseline. If your company has fewer than 1,000 employees, you are in the group Verizon found most exposed to vendor breaches. Talk with your counsel about how these laws apply to you, and use the review above to get your own house in order first.

At Oklahoma Data Partners, we help Oklahoma companies map where their data lives, who can reach it and which vendor accounts need attention. If you want a clear list and a plan to tighten access, book a consultation.