Most breach victims last year were breached through someone else
October 27, 2026. From issue 12 of The Compliance Brief, 2 stories for founders and executives who own security.
Issue 12 of The Compliance Brief was published on October 27, 2026. 2 of its 5 stories bear on breaches, incidents and security leadership, and they are below in short form. The full issue, with every take in full, is on traztech.ca.
Free weekly email
Get the next issue on Tuesday
One email a week: what changed in security and compliance, and what it means for founders and executives who own security.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.
Source: Infosecurity
Kroll found that 69 percent of data breach victims over the past year were affected through a third-party breach. Attacks on technology companies were the single most common cause.
Our take, in short
Vendor statistics usually bore me, but this one explains why your security reviews keep getting longer. When most breaches arrive through a supplier, and software vendors are the most common entry point, you are the supplier your prospect is worried about.
Read the full take on traztech.ca
Conduent proposes $80 million to end its breach class action
Source: Infosecurity
Conduent Business Services has proposed an $80 million settlement to resolve consolidated class action litigation over a 2024 cyber incident. Reporting puts the affected population at 62 million people whose healthcare data was involved.
Our take, in short
Conduent is a business services provider, meaning the people suing were never its customers. That is the shape of risk you take on when you process data on behalf of regulated clients, and it is why enterprise contracts push breach liability down to you.
Read the full take on traztech.ca
Related on HireACISO
- Our biggest deal is blocked on security
- Security maturity assessment, seven domains
- Vendor risk management, done proportionately
- 30 people and no security person
Also in issue 12
Outside breaches, incidents and security leadership, but in the same email:
- Unauthenticated RCE in PHP, exploited already
- Railway says attacker may have read decrypted environment variables
- CISA and the Cyber Centre on AI token spend as a resilience problem
Older: issue 11 All issues on HireACISO
Free weekly email
Get it every Tuesday
The next issue goes out Tuesday morning. Read it in your inbox instead of finding it here a week later.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.