Supply chain cyber security: what your organisation still owns when a supplier is breached

On Saturday 7 November, Who Gives A Crap emailed customers in Australia, the United Kingdom and the United States after personal information was accessed through a US marketing software provider. The information included names, contact details, mailing addresses and the total amount customers had spent. Payment details, passwords and order details were not involved.^[1]

The access began on 30 October, was identified on 31 October and secured on 1 November. Who Gives A Crap says the provider told it on 6 November. Customers heard from the brand the following day.^[1]

The incident happened at a supplier, but customers still heard from Who Gives A Crap. That is the organisation they trusted with their information and the organisation they expected to explain what had happened. The privacy regulator's guidance points the same way: the organisation with the most direct relationship with the people affected is usually best placed to tell them.^[7]

If a supplier incident affects your customers, systems or operations, your organisation still has work to do. You need to understand what has happened, contain any impact on your environment and decide what needs to be communicated to customers, regulators or other affected parties.

Supply chain cyber security covers the organisations that hold your information, connect to your systems, operate equipment you depend on, or provide your software and updates. It is not limited to large businesses with procurement teams. Any organisation that uses external technology providers has supplier risk to manage.

The Australian Signals Directorate (ASD) says it directly in its latest Annual Cyber Threat Report: "The cyber security risks of your suppliers and third parties are also your risks."^[2]

ASD has since turned that principle into a named control. Its Essentials framework, launched on 15 October 2026 to evolve the Essential Eight, adds supplier cyber security assurance and cyber supply chain security as explicit principles: select suppliers on the basis of a cyber supply chain risk assessment, maintain assurance evidence over time, and check the integrity of software, components and updates before use.^[10]

Three recent cases show how supplier risk reaches a customer organisation.

VIQ Solutions was a transcription provider used by Australian courts and at least 13 government agencies. Documents obtained by the ABC show the Australian Taxation Office raised concerns around March 2025 after receiving a link to a transcript that was available for download from a UK website. The Australian Securities and Investments Commission asked VIQ to investigate, accepted its report and classified that incident as a "near miss".^[3]

The OAIC later found that three employees of an India-based subcontractor accessed a limited number of Australian court hearing recordings between September 2025 and February 2026. The access occurred outside contractual arrangements that the OAIC described as privacy preserving.^[4]

The lesson from this case is that a contract with the right privacy protections did not prevent the problem. The access happened outside those arrangements. And when the earlier transcript link was found, ASIC's understanding of what had happened came from VIQ's own investigation. Supplier oversight needs to extend beyond the contract. Organisations need to know which subcontractors are involved, where the work is done, who can access their information and how an incident will be investigated and reported.

On 2 November, attackers changed temperature and defrost settings on cold-storage equipment at three sites operated by France's national blood service, through equipment managed by a refrigeration supplier. The service's monitoring and alarm systems detected the changes, products were moved to other cold storage, and the service reported that no blood products were lost.^[5] Three days later, US government agencies including the FBI warned that attackers are targeting temperature and refrigeration controllers that are out of date or can be reached from the internet, in grocery stores and cold storage facilities.^[11] We covered what to check in this week's Cyber Brief.

The supplier did not need to hold customer records to create risk. Remote access to the equipment was enough. Organisations need to know which suppliers can reach the equipment or systems they need to keep operating, how that access is protected and who is notified when unusual activity is detected.

AOMEI Technology makes Windows backup software that checks its supplier's servers for updates. Google Threat Intelligence Group and Mandiant found that attackers tampered with AOMEI's update infrastructure between April and July 2026. The changes were active for only five to 10 minutes at a time. A computer checking for updates during one of those windows could receive malicious instructions, while a computer checking before or after received the genuine files.^[6]

Google observed affected organisations in 11 countries, including Australia, in sectors such as IT services, telecommunications and higher education. AOMEI said it took corrective action on its distribution servers in late July.^[6] In late October, about three months after Mandiant alerted it, AOMEI had still not identified or notified the customers whose computers were infected.^[8]

Securing the supplier's update service stopped the same route being used again. It did not remove malicious software from computers that had already received it. Google's researchers were clear that organisations running the software "cannot assume they are protected solely because the vendor took corrective server-side action".^[6] Customers still needed to find affected devices, isolate them and confirm the threat had been removed.

The supplier may be responsible for the failure. Your organisation still needs to keep services running, answer customers or patients, investigate its own environment and assess its legal obligations.

Privacy obligations depend on the circumstances. The OAIC's guidance says personal information can be held by more than one organisation at once. For example, if your organisation keeps customer records with a cloud provider, the law treats you both as holding them: the provider because the records sit on its systems, and your organisation because your contract gives you control over them. When more than one organisation holds the same information, only one of them needs to assess the breach and notify the OAIC and the people affected, and it can do this for all of them. If nobody does, each organisation that held the information may be found in breach. Those arrangements should be agreed before an incident.^[7]

This matters because shared incidents are common. The OAIC has reported that most of the breaches it receives involving more than one organisation stem from a breach at a cloud or software provider.^[9]

This is general information, not legal advice. Important supplier contracts and individual incidents should be reviewed with a legal adviser.

Supplier oversight is how you check that what the contract requires is actually happening. For critical suppliers, that means knowing who has access, which subcontractors are involved, whether agreed security controls are operating and how you will be notified when something goes wrong.

Start with suppliers that hold sensitive information, have remote or administrative access, operate critical equipment, or provide software the organisation depends on. Ask the questions in writing and keep the answers with the contract or supplier record.

1. 01

   What information, systems or equipment of ours do you hold or access?

   Ask where information is stored, where the service is delivered and which access is required.

2. 02

   Which subcontractors are involved?

   Ask who they are, where they work, what they can access and how you will be told about a material change.

3. 03

   Who has privileged or remote access?

   Ask how access is approved, protected, logged, reviewed and removed when it is no longer required.

4. 04

   What will happen if you suspect an incident?

   Agree on a named contact, the information you will receive, how often updates will be provided and when notification must begin.

5. 05

   What evidence shows the controls are working now?

   Ask for relevant independent assessments, test results or other current evidence. After an incident, require evidence that containment and remediation have been completed.

Do not review every supplier to the same depth. Start with suppliers that hold important information, can reach systems or equipment, or could stop the organisation from operating. Rank them by the likely effect of a breach or outage.

For each critical supplier, assign a business owner, record the answers and any gaps, and set the next review date. Review the arrangement again at renewal, after a significant service or subcontractor change, and after an incident. Remove access that is no longer needed.

External suppliers are an essential part of doing business, and they can help reduce risk. What matters is whether your organisation understands where its important information and access sit, and what will happen when a supplier reports a problem.

Supplier risk management should not stop when a contract is signed. Information changes, subcontractors change and access builds up over time. Ask each critical supplier the five questions at regular intervals, so you remain confident and comfortable with their answers.

1. ABC News, 8 November 2026, "Who Gives A Crap confirms customer data exposed in software breach"
2. Australian Signals Directorate, Annual Cyber Threat Report 2025-26, p.39
3. ABC News, 30 October 2026
4. OAIC, 4 November 2026, "OAIC closes preliminary inquiries into VIQ Solutions"
5. Établissement français du sang statement, as reported by Le Quotidien du Médecin and BleepingComputer, 4 November 2026
6. Google Threat Intelligence Group and Mandiant, 15 October 2026, "Investigating Ephemeral Supply Chain Tampering"
7. OAIC, "Part 4: Notifiable Data Breach (NDB) Scheme", data breaches involving more than one entity
8. The Record, 20 October 2026, "AOMEI yet to notify customers"
9. OAIC, 22 February 2024, "Data breach report highlights supply chain risks"
10. Australian Signals Directorate, "Essentials for enterprise IT" and "What is the Essentials?", published 15 October 2026
11. CISA, FBI, HHS, USDA and DOT, 5 November 2026, "US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems" (fact sheet)