Report by Black Kite
2026 Third-Party Breach Report: Managing Risk Concentration in the Era of Cascading Failures
Key Findings
433 million people are publicly disclosed as impacted by third-party breaches.
Every breached vendor now compromises an average of 5.28 downstream companies.
An estimated 26,000 shadow victims remain impacted by vendor breach cascades but are never officially named.
Average downstream breach victims per vendor increased from 2.46 in 2021 to 5.28 in 2025.
It takes an average of 117 days for a breach to be publicly disclosed after discovery.
23.34% of the global ecosystem have corporate credentials circulating on the dark web via stealer logs.
The average disclosure window worsened from 76 days in 2024 to 117 days in 2025.
53.77% of organizations show at least one critical vulnerability detected (patch management failure).
The median disclosure delay after detection is 73 days.
Most vendors detect compromises within a median of 10 days.