Our Software Vendor Says It Was Breached and What We Do in the First 48 Hours

The email usually arrives on a Friday afternoon. A software company you pay every month says it has had a "security incident." The tone is calm. Only limited information was involved, it says, and passwords were not affected. Most owners read that, forward it to whoever handles IT, and head home for the weekend.

That moment is what this post is about. A vendor breach notice is not the end of somebody else's problem. Very often it is the first sign of yours. The next 48 hours decide whether a breach at a company you buy from stays at that company, or walks into your mailbox, your bank account, and your clients' inboxes.

I write for owners, operations managers, and controllers around McKinney and the rest of North Texas who want to know what to do, not how the attack worked at the code level. Two recent vendor breaches show the pattern clearly, and both are documented in our own threat intelligence write-ups. Neither one requires you to be a technical person to act on.

The First Notice Is a Floor, Not a Ceiling

On October 30, Chainalysis, a company whose software is used by police agencies, banks, regulators, and crypto exchanges, told customers that an outsider had accessed names, email addresses, user IDs, and role labels. It said it had found no evidence that passwords or session tokens were touched. On November 4, it told those same customers that names, usernames, password hashes, and live tokens for all of its users had been exposed. You can read the full timeline in our Chainalysis breach advisory.

Two of those terms deserve a plain explanation. A password hash is a scrambled copy of a password that a company stores instead of the real thing, and weak scrambling can sometimes be reversed. A token is a digital pass the system hands you after you log in, so you do not have to type your password again on every click. The token is the more urgent problem. It does not need to be cracked. It simply works until someone cancels it, and it usually skips the multi-factor check, which is the code from your phone that you enter after your password, because the login already happened.

The lesson for a business owner is not about crypto or blockchain. It is about how breach notices are written. The first notice goes out before the investigation is finished, so it describes the least the company knows for certain. It is a floor. If you wait for the vendor to confirm the worst case before you act, you may give an attacker five extra days inside accounts you could have closed on day one.

So the right posture on day one is simple. Assume everything you share with that vendor, every login, every key, every connection, is exposed. Act on that assumption.

Hour One: Decide Who Owns the Response

Before anyone changes a single password, one person needs to own this. In a 20-person firm in Plano or Allen, that usually means the owner or the controller, working with whoever runs IT. That might be one internal person, an outside provider, or a co-managed IT arrangement where your own staff and an outside team share the work. Write down who is doing what and when they will report back. Vendor breaches fall between chairs because the vendor believes its notice was the job, and your IT provider believes the vendor is handling it.

Then answer three questions in plain language. What do we use this vendor for? Who in our company logs into it? Is it connected to anything else we run, such as our email, our accounting system, our file storage, or our backups? The third question matters most, and most businesses cannot answer it from memory.

Set one rule for the whole company on the first day. Nobody clicks a link in any email about the breach, including emails that appear to come from the vendor itself. Chainalysis warned its customers to ignore unsolicited password reset emails, and the reason is obvious once you think about it like a criminal. A real breach notice is the perfect cover story for a fake one. Your staff already expect a reset email, so a forged one gets clicked. Strong email security filtering helps here, but the rule is free and it works today. Anyone who needs to reset a password types the vendor's web address into the browser by hand.

Hours 1 to 12: Reset, Rotate, and Hunt for Reused Passwords

The first practical step is resetting the password for every person in your company who has an account with the breached vendor. Do it through the vendor's own website, typed by hand, not through any emailed link.

If your business connects other software to that vendor, there is a second step that is easy to miss. An API key is a long, private password that one program uses to talk to another, for example your website talking to a payment processor, or your accounting system pulling data from a bank feed. Rotating a key means issuing a new one and cancelling the old one. Chainalysis required every customer to rotate API keys before they were allowed back in. The work your IT person needs to do is find every place the old key was stored, replace it, and confirm the old one is cancelled. If they skip the replacement, the integration breaks and you have created your own outage. If they skip the cancellation, the stolen key keeps working.

The third step is the one that turns a vendor breach into your breach. Chainalysis's own guidance put it well: deal with password reuse, because that is where a vendor breach turns into your breach. If an employee used the same password on the vendor's site and on your company email, the attacker now holds a working key to your email. People reuse passwords. That is not a judgment about your staff. It is simply what happens.

You will not get honest answers by asking who reused a password, so do not ask. Force a password reset on company email and any other important system for every person who had an account with the breached vendor. Ongoing dark web monitoring is useful in the weeks that follow, because it can alert you when your company's email addresses and passwords show up in collections of stolen logins.

Hours 12 to 24: Find Every Connected App That Holds the Keys

The second breach shows why the "is it connected to anything" question matters so much. On October 15, attackers used a stolen credential that belonged to the ConnectWise Cloud Backup application, formerly called SkyKick, to sign into 173 Microsoft 365 tenants. A tenant is your company's own private section of Microsoft 365, holding your mail, files, and Teams chats. The attackers never saw a password prompt and never faced a multi-factor check, because they did not log in as a person. They logged in as the backup app itself. Our ConnectWise Cloud Backup advisory covers the details.

Backup software needs deep access to do its job. That is true of every data backup tool that protects Microsoft 365. In this case, the access the attackers inherited included reading and writing to mailboxes and attachments, plus OneDrive and SharePoint files and Teams chats. Microsoft observed the attackers then trying to add fresh credentials to other connected apps, which Microsoft described as planting a backdoor. Once that happens, cancelling the original stolen credential no longer evicts them.

Here is the business translation. A connected app that can read your mailboxes can read every invoice thread and every payment conversation you have had with your clients and suppliers. That is precisely the raw material for business email compromise, often called BEC, where criminals use or imitate a real company mailbox to redirect payments to their own bank account. The vendor's breach becomes a fake invoice that goes out under your name.

So in this window, ask your IT person for three things. First, a list of every app connected to your Microsoft 365 or Google Workspace and what each one is allowed to do. Second, for the breached vendor's app specifically, disable it rather than only resetting user passwords, because the attack never depended on user passwords. Third, check whether any app had new credentials added or gained new permissions since the breach window opened. Note one more detail from the ConnectWise case: disabling the app stops new tokens from being issued, but tokens already issued can stay valid for up to ninety minutes.

One last caution. Huntress, the firm that caught the ConnectWise activity, warned that some of the attackers' reading of directory information may leave no audit trail at all. A clean log does not prove nothing happened. If you need to know what was actually read or taken, for insurance or for notifying clients, that is a digital forensics question, and it is far easier to answer when evidence is preserved early.

Hours 24 to 48: Check the Mailbox and the Money

By the second day, the question shifts from "what could they reach" to "did they use it." Two places tell you fastest.

The first is the mailbox. Ask your IT person to check every mailbox tied to finance, billing, and leadership for rules nobody remembers creating. Criminals who get into a mailbox commonly set up quiet rules that forward copies of mail to an outside address, or move replies from a particular client into a folder nobody opens. Those rules let them watch a payment conversation and step in at the right moment. If the vendor's app had mailbox access, this check is not optional.

The second is the money. Have your accounts payable team review every change to bank details, for suppliers and for clients, since the breach window opened. Any change gets confirmed by phone using a number you already had on file, never the number in the email that asked for the change. Tell your billing staff to expect clients to call asking whether a new invoice or new payment instructions are real, and to treat those calls as a warning sign, not a nuisance.

If you find a forwarding rule you did not create, or a bank detail that changed and nobody can explain it, you are no longer handling a vendor breach. You are handling your own email compromise, and the clock that matters is the one on the wire transfer. That is when to call a business email compromise response team, and our guide to the first 48 hours after a compromised Microsoft 365 mailbox walks through what happens next.

Throughout these two days, keep a simple written log of what you checked, what you found, and when. Your cyber insurance carrier will ask for a timeline, and many policies expect prompt notice of a suspected incident. A log written as you go is worth far more than one reconstructed from memory a month later.

There is also an operations question to settle. When Chainalysis took its products offline, customers spent part of a week without a tool their daily compliance work depended on. Ask what your business does if this vendor goes dark for a week. If the honest answer is "we stop invoicing" or "we stop shipping," that is a continuity gap worth closing before the next notice arrives.

What a Good Answer From Your IT Provider Sounds Like

You do not need to understand every technical step to judge whether the work was done. You need to recognize the difference between a vague answer and a specific one.

A vague answer sounds like "we looked into it and everything seems fine." A specific answer sounds like this: every vendor account was reset on a stated date, two API keys were rotated and the old ones cancelled, the vendor's app was disabled in Microsoft 365, no new credentials were added to any connected app since the breach window, no unknown mail rules were found on the six finance and leadership mailboxes, and no bank details changed. Every part of that answer is something a business owner can repeat to an insurer or a client.

If the answers stay vague, or nobody is reviewing the logs at all, that tells you something important about your coverage. It is also a good reason to look at vendor risk before the next notice instead of after it. Our third-party vendor risk guide covers the questions to ask a vendor before you connect it to your email and files.

Getting Help From a Team in McKinney

Innovation Network Design is headquartered in McKinney and works with businesses across Collin County and the DFW area. When a vendor breach notice lands, we help you work out what the vendor touched, close the doors it left open, and check your mailboxes and payments for signs the breach has already reached you. If it has, we move straight into response.

If you just received a vendor breach notice, call us at 512-518-4408 or contact our team today. If you want to know in advance which of your vendors hold the keys to your email, files, and payments, start with a security assessment.

Frequently Asked Questions

Our vendor says no passwords were exposed. Do we still need to reset them?

Yes. The first breach notice is written before the investigation is finished, and it describes the minimum the vendor can confirm. Chainalysis first said no credentials or tokens were accessed, then five days later said password hashes and live tokens for all users were exposed. Resetting costs minutes, while waiting can hand an attacker days.

How can a breach at another company become a breach at ours?

There are two common paths. The first is password reuse, where an employee used the same password on the vendor's site and on your company email. The second is a connected app, where the vendor's software was granted access to your mailboxes or files and the attacker uses that access directly, which is what happened to 173 Microsoft 365 tenants in the ConnectWise Cloud Backup incident.

How do we find out whether a vendor's app can read our company email?

Ask your IT provider for a list of every app connected to your Microsoft 365 or Google Workspace account, along with the permissions each one holds. Any app with access to read or send mail deserves a second look, and the breached vendor's app should be disabled until the vendor confirms the problem is fixed.

Should we stop using a vendor after it has been breached?

Not automatically. A breach tells you the vendor is a target, and how it handles disclosure, cleanup, and new protections tells you more than the breach itself. Decide after the first 48 hours, once your own accounts are secured, and use the vendor's follow-up updates to judge whether it deserves your continued trust.

Who should we call if we find a forwarding rule or a changed bank detail after a vendor breach?

Call your bank first if money has already moved, because recovery depends on speed. Then call an incident response team that handles business email compromise, so the mailbox is secured and the evidence is preserved before anything is deleted. In North Texas, you can reach our team at 512-518-4408.