When a Company You Don't Use Gets Breached, and It's Still Your Problem

A familiar sequence: a company publishes an incident notice, the name means nothing to you, and a week later something you do use starts behaving strangely. Modern breaches propagate through supply chains, because the firms that manage software, back up mailboxes, send email or integrate systems hold credentials for their customers' environments. Compromise one of those and you reach many organisations at once, none of whom were themselves attacked.

The practical consequence is that your exposure is not the list of companies you have accounts with. It is that list plus the vendors behind them, which you mostly cannot see. Since you cannot audit what you cannot see, the useful work is making any single compromised credential unimportant.

That means a few specific things. Unique passwords everywhere, which in practice means a password manager, because the mechanism that converts someone else's breach into your problem is reuse. Two-factor authentication on anything that matters, preferably an app or a hardware key rather than SMS. Passkeys where offered, since there is no shared secret to steal. And a deliberate look at which accounts can reset the others: your email is the master key, and it deserves the strongest protection you are willing to maintain.

When a notice does land and you think it might touch you, work in this order. Change the password for the affected service first, and change it anywhere you reused it, which is the step people skip. Then sign out of all sessions, because a stolen session token survives a password change until it is explicitly revoked; most services have a "log out everywhere" control. Next, review connected apps and API tokens for that account and revoke anything you do not recognise or no longer use. Check the account's own security log, if it has one, for sign-ins from places you have not been. If the service holds payment details, watch the statement rather than trusting a notification to arrive.

For anything business-adjacent, add two more steps: check mailbox rules, since attackers commonly add a forwarding or filing rule to stay quiet, and check whether anyone else in the organisation used the same credential.

Two habits make all of this much cheaper. Register with a breach notification service such as Have I Been Pwned so you hear about exposures involving your address without relying on the breached company to tell you promptly. And reduce the surface: close accounts you no longer use, because dormant accounts still hold data and still share whatever password you set years ago.

The uncomfortable summary is that you cannot prevent other people's breaches, and the number of parties holding something of yours is larger than your account list suggests. What you can control is whether one leaked credential opens one door or many, and that is decided in advance, by whether you reused it.