The insurance sector ranked ninth for the number of organizations breached in Kroll’s case data between June 2025 and June 2026, accounting for 5% of breaches according to the full Data Breach Outlook 2026 report, but second for the total number of individuals affected, behind only technology. That gap between breach frequency and individual impact is the report's central finding, and it points directly to how third-party exposure amplifies the reach of a single incident.
Kroll's study draws on breach incident data from June 2025 to June 2026 and a companion survey of 250 risk and compliance leaders and C-suite executives.
Of all individuals affected across Kroll-handled cases in the twelve-month period, 69% were impacted by a third-party breach, meaning one that originated at a vendor, contractor, or service provider rather than at the organization holding the data. Looking specifically at those third-party-affected individuals, the technology sector accounted for 79%, with finance at 9%, insurance at 6%, and healthcare at 5%.
Across all Kroll-handled cases, not just third-party breaches, technology ranked first for individuals affected, followed by insurance at 10%. Insurance-sector breaches ranked ninth by organization count but second by people affected overall, a split that reflects how deeply interconnected insurers and their technology providers have become.
Katherine Keefe, managing director and global cyber insurance industry lead at Kroll, drew a direct line from that data to how cyber claims accumulate. “A single vendor or platform compromise does not produce one claim,” she said. “Such a compromise produces dozens, sometimes hundreds of claims filed by unrelated policyholders who share nothing but a common vendor.” The result, she noted, is aggregation risk, which is a loss pattern that behaves nothing like the single-victim breach the cyber market was originally built to price.
Underwriters are adjusting. Keefe said carriers are scrutinizing vendor risk management more closely at initial underwriting and at renewal, and are looking specifically at vendors that serve wide swaths of a particular industry. Claims handling is shifting too. When multiple insureds are drawn into the same root-cause event, teams require coordinated incident response and breach notification approaches that differ from standard single-insured workflows. Cyber underwriters and cyber claims professionals dealing with vendor-driven aggregation events are increasingly working through scenarios that the market’s early pricing models did not contemplate.
The full report also recorded an 87% year-on-year increase in insurance-sector breaches, a figure absent from the press release, but worth noting alongside the impact numbers. It comes with the caveat that Kroll’s dataset reflects the incidents it handled rather than the market as a whole, so the increase signals direction rather than scale. Still, the combination of rising frequency and disproportionate individual impact puts the sector’s vendor relationships under a sharper lens than most breach rankings suggest.
Kroll’s companion survey of 250 risk and compliance leaders and C-suite executives adds another dimension. IT and technology leaders identified vendor and third-party breaches as their single biggest compliance risk at 54%, compared with 40% of C-suite executives and 30% of dedicated risk and compliance leaders. Vendor dependencies also ranked among the top four breach-response challenges, cited by 41% of respondents. The pattern held across organizations of all sizes, suggesting it is a structural issue rather than a resourcing one.
Denyl Green, global head of breach notification at Kroll, pointed to preparedness as the variable that most affects how organizations manage when a supplier is compromised. “The businesses that respond most effectively have already mapped their third-party relationships and the subsequent domino effect, with an agreed plan in place before an incident happens,” she said. “That preparation can reduce both the complexity and the cost of managing a breach.”
That observation runs parallel to what underwriters are increasingly asking during the application and renewal process. Vendor risk has moved from a secondary line of questioning to a primary one in how underwriters assess applicants and evaluate renewals. Whether a client has mapped its third-party relationships and documented high-risk dependencies is now a factor in how coverage is structured, rather than just whether it is granted.
