Two numbers from Kroll’s Data Breach Outlook 2026 should reset how hospital boards score third-party risk. Of every individual caught in a breach the firm handled between June 2025 and June 2026, 69% were hit through a vendor, contractor or service provider. Within that third-party group, 79% traced back to technology suppliers.
Kroll’s sample covers 250 risk, compliance and executive respondents. Finance topped the count of breached organisations, professional services came next, and healthcare slipped to third with 15% of handled cases – the first time since 2022 the sector has fallen out of the top two.
Health systems argue the ranking misleads. HHS Office for Civil Rights tallies show 593 large breaches reported in the first nine months of 2026, with business associates behind just 21% of them but 41% of affected individuals.
Concentration is the mechanism. One platform serving hundreds of providers converts a single compromise into hundreds of claims, a loss pattern Katherine Keefe, Kroll’s cyber insurance industry lead, describes as aggregation risk the market was never built to price.
Splits inside organisations matter too. Fifty-four percent of IT and technology leaders named vendors their biggest compliance risk, against 39.7% of C-suite executives – the people closest to the relationship see the danger most clearly.
For defenders the practical read is that business associate agreements are a starting point, not assurance. Vendor inventory, least-privilege integration and tested exit paths do more than any clause.
