A company can follow its own security procedures and still inherit a breach from the vendor that handles its payroll data.
What two live incidents show
On August 14, 2026, Frontline Education’s security team identified a vulnerability in a third-party software product it uses. Frontline said the flaw allowed unauthorized access to a portion of its environment. BleepingComputer reports that school districts are being notified that employee Social Security numbers, email addresses, and physical addresses were exposed. One district administrator reported 1,210 affected employees at their district. Frontline has not said how many districts or people were affected, and it has not named the third-party product, so the districts cannot see which flaw reached their data.
Fakturownia, a Polish invoicing platform used by more than 600,000 businesses, was breached when an attacker exploited a vulnerability in its systems. The Record reports that the exposure potentially covers account data, password hashes, bank account information, authentication and integration tokens, and information belonging to customers and business partners. A person using the name “Fingerprint” claimed to have stolen 6 terabytes of invoices, a figure that has not been independently verified. A review found no breach of KSeF, Poland’s national e-invoicing system, and payment card data was not affected.
In both cases the data belonged to organizations that did not run the system where it was exposed. Those organizations are now answering questions about an incident they could not have patched.
Why a vendor’s breach becomes your business problem
A supplier incident doesn’t stay the supplier’s problem. Depending on the state and the contract, the notification duty can land on the company that owns the data rather than the vendor that lost it. A customer whose information was exposed has a relationship with the company, not its vendor, so the company is the one that gets the call. A contract with a customer or an insurer can also create a claim if the company didn’t do the diligence it promised on that vendor.
The Fakturownia case adds a layer that’s easy to miss. Authentication and integration tokens were part of what leaked. A token isn’t a password a person can be told to change. It’s a standing connection between systems, and if it’s stolen, the exposure doesn’t end when the original breach is contained. It ends when someone rotates every token that was exposed.
What an annual questionnaire doesn’t tell you
A vendor security questionnaire completed last January says nothing about whether that vendor patched the vulnerability that got exploited in August. It says nothing about whether the vendor could detect an intrusion, or how fast it would tell its customers. Frontline’s disclosure shows the gap. The company found the flaw on August 14 and investigated with an independent cybersecurity firm, yet the notification letter was not reported until October 2, nearly seven weeks later, and the product at fault is still unnamed.
A questionnaire doesn’t produce evidence. A vendor that can show its patch cycle and its notification deadlines is managing risk. A vendor that can only point to a completed form from last year is managing paperwork.
A tiering model that matches exposure to oversight
Not every vendor deserves the same scrutiny, and treating them all the same is how the scrutiny that matters gets diluted. The first split is simple: which vendors only store sensitive data, and which vendors can reach into systems or move money. A marketing tool that holds a mailing list is not the same risk as a payroll platform with write access to bank details.
The second split is about the business, not the vendor. A vendor whose compromise would stop production or halt billing earns deeper testing and a shorter leash than one that would merely be inconvenient to replace. In a private equity portfolio, this matters at a different scale: one weak platform shared across several portfolio companies can turn a single vendor incident into several simultaneous ones.
What the next vendor contract should actually require
A vendor contract that says nothing about the parts that matter after a breach leaves the company negotiating in the middle of an incident. The fix is specific. Replace “promptly” with a notification deadline in hours or days, and require the vendor to cooperate with the company’s investigation and preserve the evidence it needs. Settle in advance who speaks to the company’s customers when the exposed data was theirs. Asking for these terms costs little before an incident and a lot after one.
One more clause belongs in every vendor agreement now: a required token and credential rotation, with an access review, triggered automatically by any confirmed incident on the vendor’s side. Fakturownia’s exposed tokens are the argument for that clause.
Pick the five vendors whose compromise would do the most operational or regulatory damage, and review their contracts and access this quarter.