By Anthony Moussa, President, Moo IT Solutions | Totowa, NJ
Third-party vendor cyber risk is the chance that a hacker breaks into a company you depend on, like your cloud software, your payroll provider or your online ordering platform, and takes your business down with it. You didn’t click the bad link. Your team didn’t make a mistake. But your customers still can’t reach you, your staff can’t work, and the phone calls come to you.
October 2026 showed how real this is. Here is what happened, what it means for owners and executives, and three questions to put on your next leadership meeting agenda.
What happened this month
None of these organizations were the weak link themselves. In each case, an attack on a system run by someone else stopped normal business.
A grocery chain’s apps went dark for more than a week
On October 12, a cyberattack on Stop & Shop’s parent company, Ahold Delhaize, knocked the grocery chain’s website and app offline, along with sister chains Hannaford and Giant Food. Millions of shoppers couldn’t order online or use loyalty points until services were restored on October 20, more than a week later. Stores stayed open, but the digital side of the business stopped (The Boston Globe).
Bankruptcy courts couldn’t send official notices
BAE Systems runs the Bankruptcy Noticing Center for the federal courts. A cybersecurity incident at BAE halted the production and distribution of bankruptcy notices for courts across the country. On October 22, the Judicial Conference declared a “Bankruptcy Rules emergency” so judges could extend deadlines. The system came back online on October 27 (U.S. Courts). For law firms, lenders and anyone waiting on a court deadline, one vendor’s problem became everyone’s calendar problem.
Lab patient records were accessed through an online portal
On October 21, Quest Diagnostics learned of unauthorized access to Quanum Lab Services Manager, a system some clients use to place test orders and look up results. In its filing with the SEC, Quest said it believes an unauthorized party accessed certain patient records (Quest Diagnostics Form 8-K). Medical practices that rely on outside portals like this one now have patients asking questions they can’t fully answer yet.
A cloud provider’s customers were told to lean on their own backups
On October 7, ransomware hit IDC Frontier, a SoftBank cloud company in Japan, affecting almost 500 corporate and municipal customers. The company warned that restoring customer data from the affected systems would be difficult, and many customers might have to restore everything from their own backups (Kaseya). If your only copy of your data lives with the vendor that got hit, you may have no way back.
Why third-party vendor cyber risk is a business problem, not an IT problem
Every company today runs on other companies’ software: accounting systems, practice management tools, tenant portals, project management apps, email and file sharing. That’s usually a smart move. But it means some of your most important risks sit outside your four walls.
When a vendor goes down, the costs land on you:
- Downtime. Staff can’t work, orders can’t go out, and invoices don’t get sent.
- Money. Lost sales, overtime to catch up, and emergency help that costs more than planned help.
- Liability and compliance. If client, patient or tenant data is exposed, you may have notification duties, contract obligations and tough conversations with regulators or insurers. Your attorney and your insurance broker should weigh in on what applies to you.
- Reputation. Customers don’t care whose server it was. They remember that you were down.
The good news: you can’t control your vendor’s security, but you can control how prepared you are when they have a bad day. That’s what business continuity planning is about.
3 questions for your next leadership meeting
Print these out. If anyone at the table answers “I’m not sure,” that’s your starting point.
1. If a key vendor went dark tomorrow, how long could we keep operating?
List the five outside systems your business can’t live without. For each one, decide what your team would do for a day, a week and a month without it. Manual workarounds, paper forms and a phone tree are not glamorous, but they keep the doors open.
2. Do we keep our own backup of our data, or only theirs?
Many cloud tools protect their own systems, not necessarily your ability to get your data back quickly. Make sure you have backups you control, stored separately from the vendor, and that someone actually tests restoring them. Our backup and disaster recovery service is built around exactly this.
3. Who has access to our systems, and who is checking?
Vendors often have logins or connections into your email, files and accounting. Old vendors, former employees and “temporary” access tend to pile up. Someone should review that list regularly, remove what isn’t needed and watch for unusual activity. A cyber risk assessment is a fast way to see where you stand.
What this looks like for your industry
- Property managers: Tenant portals, rent payments, maintenance requests and building access systems are often run by outside providers. Our free IT checklist for property managers walks through what to check.
- Law firms: Court notices, document management and billing platforms all depend on vendors. Missed deadlines are a malpractice risk, not just an inconvenience.
- Healthcare practices: Labs, EHRs and patient portals hold protected health information. A vendor breach can still mean patient letters and HIPAA questions for your practice.
- Construction companies: Project management, estimating and payroll tools keep crews moving. When they stop, so do job sites and payments.
How Moo IT helps
Moo IT Solutions has provided managed IT services and cybersecurity since 2006, from our office in Totowa, NJ. We help businesses across New Jersey, New York City and beyond put vendor breach protection in place before they need it: backups you control, a written plan for when a key system goes down, regular reviews of who has access, and 24/7 support when something goes wrong.
Want a simple place to start? Grab our free Business Comeback Checklist.
Vendor risk is one layer. See what our 24/7 SOC caught in just 2½ days, and how our cybersecurity services cover every layer.
Frequently asked questions
What is third-party vendor cyber risk?
Third-party vendor cyber risk is the risk that a cyberattack on a company you rely on, such as a software, cloud or service provider, disrupts your business or exposes your data, even if your own systems were never breached.
If my cloud software vendor gets hacked, is my data still backed up?
Not necessarily. Some vendors keep backups of their own systems, but in October 2026 one cloud provider warned that many of its customers might have to restore everything from their own backups. The safest approach is to keep your own backup, stored separately and tested regularly.
How can a small business reduce vendor risk without a big IT team?
Start with three steps: list the vendors you can’t operate without and plan a workaround for each, keep your own tested backups of critical data, and review who has access to your systems at least a few times a year. A managed IT provider can handle the monitoring and testing for you.
Who is responsible when a vendor’s breach exposes my clients’ data?
It depends on your contracts, your industry and the laws that apply to the data, so talk with your attorney and insurance broker. Either way, your clients will look to you for answers, so it pays to know your vendors’ obligations before an incident happens.
Let’s make sure a vendor’s bad day doesn’t become yours
Call Moo IT Solutions at (888) 894-4780 or book a consultation at mooit.com. We’ll help you answer those three questions with confidence.
