The email arrives on a Tuesday afternoon. The subject line is some corporate variation of “Notice of a Data Security Incident.” It’s from your payroll provider, or your scheduling software, or the portal your bookkeeper uses.
You read it twice. Nobody on your team clicked a bad link. No one reused a weak password. Your firewall did its job.
And your data is gone anyway.
This is the security problem almost nobody prepares for. Most advice assumes the attack shows up at your door — a phishing email, a suspicious download, a stranger calling the front desk. This one already happened, weeks ago, somewhere you couldn’t see it, at a company you pay every month.
You Have More Vendors Than You Think
Before the next notice lands, try this exercise: list every outside company that holds data about your business, your employees, or your customers.
Most small business owners start strong and then stall around number six. The real list usually runs far longer — payroll and benefits, the booking or scheduling tool, your accounting platform, the bookkeeper’s client portal, your CRM, email marketing, the online ordering system, the HR onboarding app someone set up in 2023, and whatever your point-of-sale vendor connects to.
Every one of those is a place your data lives that you don’t control. You can run perfect security inside your own walls and still get burned by a company three steps removed from your office.
How This Actually Plays Out
A well-documented example shows the shape of the problem clearly. In August 2025, attackers obtained authentication tokens belonging to a third-party chat and sales tool that many companies had connected to their customer databases. Using those stolen tokens, they quietly exported large volumes of data from a long list of corporate accounts.
Here’s the part that matters for you. According to Google’s Threat Intelligence Group, which investigated the campaign, the attackers’ main goal wasn’t the customer records themselves. They were sifting the stolen data looking for credentials — passwords, access keys, and tokens that had been typed into support tickets and notes over the years. Those credentials become the keys to break into somewhere else entirely.
Not one of the affected businesses made a mistake. They had simply connected a legitimate tool to another legitimate tool, which is what every modern business does a dozen times over.
The First Few Hours: Read the Letter Properly
Breach notices are written by lawyers, and the wording is doing careful work. Slow down and pull out four specific facts before you do anything else.
What was actually involved. “Accessed” and “acquired” are different claims. So are “may have included” and “included.”
Which data types. Names and email addresses are a nuisance. Social Security numbers, bank account details, and driver’s license numbers are a different category of problem entirely.
The date range. When did the exposure start, and when did they catch it? A gap of several months tells you how long someone had to use what they took.
Whose data it was. Yours as a business? Your employees’? Your customers’? That answer drives everything that follows, including whether you have legal obligations of your own.
The First Day: Assume Credential Reuse
This is where the Drift example earns its place. Attackers mine breached data specifically to find passwords that unlock other systems. So the question isn’t just “what did they get from this vendor” — it’s “where else does that same password work?”
Change the password on the breached vendor’s system. Then change it anywhere your team may have reused it, which is realistically more places than anyone will admit to.
Revoke and reissue any API keys or integration tokens tied to that vendor. If that tool was connected to your Microsoft 365, your accounting system, or your CRM, disconnect it until the vendor confirms the all-clear.
Confirm multi-factor authentication is switched on everywhere it’s available — especially email. A stolen password is far less useful against an account that also demands a code.
Finally, check the vendor’s own login history for your account if the platform offers it. Unfamiliar sessions or logins from odd locations are worth a phone call.
The Second Day: Brace for the Follow-On Scam
Here’s the step that most breach advice skips entirely, and it’s the one that catches people.
Once a breach becomes public, criminals know two valuable things: that it happened, and roughly who received a notification letter. That makes a ready-made pretext. The emails and phone calls that follow don’t invent a fake story — they reference the real incident, by name, with accurate details pulled from the vendor’s own public statement.
They’ll offer to enroll you in credit monitoring. They’ll ask you to “re-verify” your account because of the incident. They’ll send an official-looking form to confirm which of your records were affected. Some will call, sounding genuinely helpful, and walk you toward handing over the exact credentials you just finished resetting.
The rule is simple and it has no exceptions. Never act on an inbound message about a breach. Not a link, not a phone number in an email, not an attachment. If you want to check on your account, close the message and go to the vendor yourself — type the address you already know, or call the number on an old invoice.
Tell your staff this out loud, too. The person most likely to receive the follow-up call is whoever handles your billing, and they may never have seen the original notice.
You May Have Your Own Notification Duty
If the breached vendor was holding data about your Colorado customers or employees, the obligation to notify those people can land on you — not just on the vendor who lost it.
Colorado law (C.R.S. 6-1-716) requires notifying affected Colorado residents in the most expedient time possible and without unreasonable delay, and no later than thirty days after determining that a breach occurred. Larger incidents can also trigger a report to the Colorado Attorney General’s office.
This is genuinely legal territory, so please treat the above as a reason to make a phone call rather than as advice you can act on alone. Talk to your attorney early — the thirty-day clock is shorter than it sounds once you’re trying to establish what actually happened. The FTC’s “Data Breach Response: A Guide for Business” is a solid plain-English starting point for the conversation.
What to Do Before the Next One
There will be a next one. Vendor breaches are now a routine cost of running a business on modern software, and the realistic goal is a faster, calmer response — not immunity.
Build the vendor inventory while nothing is on fire. One page: who they are, what data they hold, and who at your company owns the relationship. When a notice lands, you’ll know in thirty seconds whether it matters.
Review your connected apps every quarter. In Microsoft 365, Google Workspace, and most CRMs, you can see which third-party tools have standing permission to read your data. Revoke the ones nobody uses anymore. That abandoned integration from two years ago is still a live door.
Stop password reuse properly, with a password manager rather than good intentions. Reuse is the mechanism that turns someone else’s breach into your breach.
Turn on MFA everywhere, especially email. And when you sign or renew a vendor contract, check that it actually requires prompt breach notification to you — plenty of agreements are vaguer on that point than you’d hope.
The Short Version
You can’t prevent a vendor breach. You can control how fast you find out what it touched, how quickly you cut off reused credentials, and whether your team recognizes the second wave of scams for what it is.
If you’d rather not build that vendor inventory yourself — or you’ve got a notice sitting in your inbox right now and want a second set of eyes on it — that’s squarely what we do. Castle Rock Sky works with businesses across Castle Rock and the south Denver metro on exactly this kind of unglamorous, genuinely useful preparation.
Get in touch and we’ll help you figure out who’s holding your data, and what to do when one of them loses it.
