--- title: The Breach You Did Not See Coming Probably Started at a Vendor description: Your business doesn't have to get hacked directly to be exposed. See how vendor supply chain attacks are defining 2026 and what you can do about it. image: https://blog.yournucleus.ca/hubfs/Untitled%20design%20(29).png --- [Skip to content](https://blog.yournucleus.ca/the-breach-you-did-not-see-coming-probably-started-at-a-vendor#main-content) [![Nuc-logo-sketched-1 (1)](https://blog.yournucleus.ca/hs-fs/hubfs/nucleus-images/Nuc-logo-sketched-1%20(1).png?width=220&height=44&name=Nuc-logo-sketched-1%20(1).png "Nuc-logo-sketched-1 (1)")](https://yournucleus.ca) - About Show submenu for About ![](https://blog.yournucleus.ca/hubfs/nucleus-images/caret.png) - [About Nucleus](https://yournucleus.ca/about/) - [Careers](https://yournucleus.ca/careers/) - [History](https://yournucleus.ca/about/history/) - [Team](https://yournucleus.ca/about/team/) - Services Show submenu for Services ![](https://blog.yournucleus.ca/hubfs/nucleus-images/caret.png) - [Managed IT Support](https://yournucleus.ca/services/managed-it-support/) - [Cybersecurity Services](https://yournucleus.ca/services/cybersecurity-services/) - [Managed AI Solutions](https://yournucleus.ca/services/managed-ai-solutions/) - [IT Consulting](https://yournucleus.ca/services/it-consulting/) - [Microsoft 365](https://yournucleus.ca/services/microsoft-365/) - [vCIO](https://yournucleus.ca/services/vcio/) - [ALL](https://yournucleus.ca/services/) - Results Show submenu for Results ![](https://blog.yournucleus.ca/hubfs/nucleus-images/caret.png) - [Architecture](https://yournucleus.ca/results/architecture-engineering-construction/) - [Legal](https://yournucleus.ca/results/legal/) - [Mining](https://yournucleus.ca/results/mining/) - [All](https://yournucleus.ca/results/) - [Blog](https://blog.yournucleus.ca) - About Show submenu for About ![](https://blog.yournucleus.ca/hubfs/nucleus-images/caret.png) - [About Nucleus](https://yournucleus.ca/about/) - [Careers](https://yournucleus.ca/careers/) - [History](https://yournucleus.ca/about/history/) - [Team](https://yournucleus.ca/about/team/) - Services Show submenu for Services ![](https://blog.yournucleus.ca/hubfs/nucleus-images/caret.png) - [Managed IT Support](https://yournucleus.ca/services/managed-it-support/) - [Cybersecurity Services](https://yournucleus.ca/services/cybersecurity-services/) - [Managed AI Solutions](https://yournucleus.ca/services/managed-ai-solutions/) - [IT Consulting](https://yournucleus.ca/services/it-consulting/) - [Microsoft 365](https://yournucleus.ca/services/microsoft-365/) - [vCIO](https://yournucleus.ca/services/vcio/) - [ALL](https://yournucleus.ca/services/) - Results Show submenu for Results ![](https://blog.yournucleus.ca/hubfs/nucleus-images/caret.png) - [Architecture](https://yournucleus.ca/results/architecture-engineering-construction/) - [Legal](https://yournucleus.ca/results/legal/) - [Mining](https://yournucleus.ca/results/mining/) - [All](https://yournucleus.ca/results/) - [Blog](https://blog.yournucleus.ca) [Contact](https://yournucleus.ca/contact/) [1-844-301-HELP](tel:1-844-301-4357) # The Breach You Did Not See Coming Probably Started at a Vendor May 22, 2026   |  [Security](https://blog.yournucleus.ca/tag/security) ![Untitled design (29)](https://blog.yournucleus.ca/hs-fs/hubfs/Untitled%20design%20(29).png?width=2240&height=1260&name=Untitled%20design%20(29).png) So far in 2026, the pattern has been hard to ignore. Across North America, attackers have repeatedly hit software vendors, benefits administrators, and outsourcing firms that thousands of organizations depend on. The businesses whose data was exposed did not get hacked themselves. Their vendors did. A fintech vendor breach exposed financial data for 672,000 people across multiple banks and credit unions. A healthcare revenue cycle vendor was compromised through stolen credentials, affecting 140,000 patient records. A benefits administrator API exposure put 2.7 million people at risk. In Canada, [Telus Digital](https://www.cybersecuritydive.com/news/telus-digital-cyberattack-shinyhunters/814817/) confirmed a significant data theft from its outsourcing operations. The common thread is that none of these vendors were the intended target. Their clients were.   ## What You Can Take From This These incidents point to a few things that every business leader should be thinking about right now. Map your data exposure. Know where your data actually lives. Not just which platforms your team uses, but which vendors have access to sensitive information on your behalf. If you cannot answer that question clearly, that is the first thing to fix. Raise the bar at renewal. A vendor having a certification is a starting point. What matters more is how they manage access, how quickly they notify you when something goes wrong, and whether their security controls are independently verified. Build a verification culture. Treat email with more skepticism than feels comfortable. Business email compromise losses averaged over $160,000 per incident this past year, according to FBI data. AI is making these attacks harder to spot because they match the tone and context of real business communications. Building a culture where verification is expected, not awkward, is one of the most practical defenses available. Size is not a shield. 88% of ransomware incidents involve small and mid-sized businesses. Fewer than half of Canadian SMBs say they are prepared for a cyberattack. Attackers are not choosing targets based on brand recognition. They are scanning for weak points, and automation makes it easy to find them. LINK: [Cybersecurity Services Page](https://yournucleus.ca/services/cybersecurity-services/)   ## How Nucleus Is Built for This We are part of your supply chain, and we think about that constantly. Nucleus does not host your data. Your data lives in the platforms you own or license, whether that is Microsoft 365, your practice management system, or another platform you own or license. What we have is [delegated access to manage those systems](https://yournucleus.ca/services/managed-it-support/) on your behalf, and we treat that access with the discipline it requires. That means just-in-time access rather than standing administrative privileges. It means SOC 2 Type II certification as independent proof that our controls around that access are working overtime, not just designed well on paper. And it means we hold ourselves to the same standard we encourage you to apply to every vendor in your ecosystem. The breaches from earlier this year happened to organizations holding large volumes of client data. That is a different model from an MSP with time-limited, scoped access to systems you control. But any provider with access to your environment is still a link in the chain, and every link should be able to answer the hard questions. Those questions have good answers. We are happy to walk through them. If you want to talk about your vendor risk posture or how we manage access on your behalf, [reach out to your account team](https://yournucleus.ca/contact/)or visit [yournucleus.ca](https://yournucleus.ca/). ![Nucleus Pulse Image](https://blog.yournucleus.ca/hubfs/nucleus-images/Group%20399.png) ![Picture of Karl Fulljames, CTO](https://blog.yournucleus.ca/hs-fs/hubfs/Karl-1.png?width=115&name=Karl-1.png) [Karl Fulljames, CTO](https://blog.yournucleus.ca/author/karl-fulljames-cto) ## We are local! WE HAVE PRESENCE IN VICTORIA, VANCOUVER, PRINCE GEORGE, CALGARY, AND TORONTO. [Victoria](https://yournucleus.ca/victoria/) [Vancouver](https://yournucleus.ca/vancouver/) [Calgary](https://yournucleus.ca/calgary/) [Toronto](https://yournucleus.ca/toronto/) [Prince George](https://yournucleus.ca/prince-george/) ## Ready to take your business to the next level? [Get Started](https://yournucleus.ca/contact/) ![pulse animation](https://blog.yournucleus.ca/hs-fs/hubfs/nucleus-images/pulse-animation.gif?width=806&height=61&name=pulse-animation.gif) ![Nucleus-Networks-Managed-IT-Services-Provider-REV-Logo](https://blog.yournucleus.ca/hubfs/nucleus-images/Nucleus-Networks-Managed-IT-Services-Provider-REV-Logo.png "Nucleus-Networks-Managed-IT-Services-Provider-REV-Logo") ![Apple-and-Microsoft-Office-Ready](https://blog.yournucleus.ca/hubfs/nucleus-images/Apple-and-Microsoft-Office-Ready.png "Apple-and-Microsoft-Office-Ready") **FRIENDLY** [twitter](https://www.twitter.com) [facebook](https://www.facebook.com) [linkedin](https://www.linkedin.com) [instagram](https://www.instagram.com) ### ABOUT - [History](https://yournucleus.ca/about/history/) - [Careers](https://yournucleus.ca/careers/) - [Our Team](https://yournucleus.ca/about/team/) - [Blog](https://blog.yournucleus.ca/) ### SERVICES - [IT Support](https://yournucleus.ca/services/managed-it-support/) - [Cybersecurity](https://yournucleus.ca/services/cybersecurity-services/) - [vCIO Services](https://yournucleus.ca/services/vcio/) - [Cloud Services](https://yournucleus.ca/services/cloud-services/) - [Microsoft 365](https://yournucleus.ca/services/microsoft-365/) - [IT Consulting](https://yournucleus.ca/services/it-consulting/) - [Managed Voice](https://yournucleus.ca/services/managed-voice-services/) ### CONTACT US - 1 844 301 4357 - [sales@yournucleus.ca](mailto:sales@yournucleus.ca) - [help@yournucleus.ca](mailto:help@yournucleus.ca) - careers@yournucleus.ca ### LOCATIONS - VANCOUVER 880 – 505 Burrard St. [+1 604 682 3444](tel:%20+1-604-682-3444) - VICTORIA [+1 844 301 4357](tel:%20+1-844-301-4357) - CALGARY [+1 587 393 1141](tel:%20+1-587-393-1141) - TORONTO [+1 416 628 3718](tel:%20+1-416-628-3718) © 2023 NUCLEUS  |  [TERMS OF USE](https://yournucleus.ca/terms-of-use/)  |  [PRIVACY POLICY](https://yournucleus.ca/privacy-policy/)  |  POWERED BY LOOMO ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Karl Fulljames, CTO", "url" : "https://blog.yournucleus.ca/author/karl-fulljames-cto" }, "dateModified" : "2026-05-22T22:00:16.402Z", "datePublished" : "2026-05-22T22:00:16.000Z", "headline" : "The Breach You Did Not See Coming Probably Started at a Vendor", "image" : [ "https://blog.yournucleus.ca/hubfs/Untitled%20design%20(29).png" ], "mainEntityOfPage" : { "@id" : "https://blog.yournucleus.ca/the-breach-you-did-not-see-coming-probably-started-at-a-vendor", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.yournucleus.ca/hubfs/Illustrated%20Logo.png" }, "name" : "Nucleus Networks Inc." } } ```