Your Vendor Got Hacked. Here’s Why You Still Have a Problem.

Reviewed by Tom Moore, Agency Partner, CA Agency Insurance License 6003355
Last reviewed: 4/03/2026

Key takeaway: A vendor cyber breach occurs when a third-party provider — your payroll platform, scheduling software, cloud storage service, or any outside vendor with access to your customer or employee data — experiences a security incident that exposes data your business is responsible for protecting. Even though the breach happened on the vendor’s systems, not yours, you may still owe your customers legal notification under Washington state law, face civil liability, and absorb costs your current business insurance won’t touch. Spokane small business owners with any cloud-based tools, SaaS platforms, or outside services handling personal data need standalone cyber liability coverage, not just a standard BOP.

You got an email from one of your software vendors. A security incident. Customer data may have been exposed. “We’re investigating,” they say. “We’ll keep you updated.”

Here’s what most small business owners do next: nothing. They assume the vendor handles it. Their vendor has their own insurance. That’s the vendor’s problem.

That assumption is expensive.

Washington state’s data breach law doesn’t ask whose systems were compromised. It asks whether personal information belonging to Washington residents was exposed — and whether your business controlled or licensed that data. If the answer is yes on both counts, the notification obligation falls on you. Not the vendor. You.

What Is a Vendor Cyber Breach — and Why Does It Land on Your Doorstep?

A vendor cyber breach happens when a third-party service — your payroll processor, scheduling app, email marketing platform, or any outside software with access to client or employee records — gets hit with a cyberattack or data exposure event. The attacker never touched your network. But the data that was exposed? It came from your client list. Your employee records. Your intake forms. You collected it. You’re legally connected to it. The NAIC has published guidance tracking that small businesses have seen a 28% rise in cyberattack incidents since 2022 — and vendor-based attacks are a growing share of that trend. According to the 2025 Verizon Data Breach Investigations Report, 30% of breaches now involve third parties, double the rate from the prior year. That number keeps climbing as small businesses plug more cloud tools into their operations. For a Spokane service business — a salon, a contractor, a therapy practice, a staffing firm — this is not a theoretical risk. It’s a live one. You hand off data to vendors every time a client fills out an intake form on a third-party platform, every time your staff logs into a cloud-based scheduling tool, every time payroll runs through an outside processor.

Your Washington State Notification Duties Don’t Care Whose Fault It Was

Washington’s data breach notification statute applies to any business that owns or licenses personal information about state residents — regardless of where the breach actually happened. The exposure doesn’t have to originate on your systems. It has to involve data you’re responsible for. That’s a meaningful distinction. Most small business owners think of a data breach as something that happens to them — a hacker breaks into their system. But the law covers situations where data you provided to a vendor is exposed through the vendor’s failure. The Washington Attorney General maintains a public directory of breach notices submitted under RCW 19.255.010. Scroll through it sometime. A lot of those notices are from businesses that weren’t hacked — they were connected to someone who was.

What RCW 19.255.010 Actually Requires of You

Under RCW 19.255.010, if a breach of personal information is reasonably believed to have occurred, you must notify affected Washington residents without unreasonable delay — no more than 30 calendar days after discovery. If the breach affects more than 500 Washington residents, you also have to notify the state Attorney General’s office. Notification has to include a description of what happened, the types of information involved, steps the affected individuals can take to protect themselves, and what your business is doing to investigate and respond. That process costs money. Legal review. Notification logistics. Credit monitoring offers. Response management. Whether your vendor caused it or not, those costs belong to you.

Why Your Business Owner’s Policy Won’t Cover This

The standard Business Owner’s Policy (BOP) was designed for physical business risks — slip-and-falls, property damage, product liability. It was not built for data events. Most BOPs include some reference to “electronic data” coverage, but the sublimits are typically low, the definitions are narrow, and the coverage was written before cloud-based vendor relationships became the norm for small businesses. General liability won’t respond to a data breach notification event. It doesn’t cover the cost of telling 400 clients their email and credit card data was exposed through your scheduling software. It doesn’t cover the regulatory exposure that follows. The Washington State OIC has outlined the obligations licensees face when a breach occurs, and those obligations trigger response costs that standard commercial policies simply weren’t designed to absorb.

This is the gap that catches Spokane small businesses off guard. They have a BOP, maybe a GL policy, maybe an umbrella. They think they’re covered for most things. They are — until a data event hits. Then they’re looking at five-figure notification and response costs with no policy responding.

What a Standalone Cyber Policy Actually Covers in a Vendor Breach Scenario

A standalone cyber liability policy is built for exactly this situation. When a vendor breach triggers your notification obligations under Washington law, here’s what a properly structured cyber policy typically covers: breach response costs, including legal counsel and forensic investigation; notification expenses, including printing, postage, and call center support; credit monitoring services for affected individuals; regulatory defense costs if the AG’s office gets involved; and third-party liability if affected clients sue your business for the exposure. The Insurance Information Institute’s guidance on cyber coverage notes that both first-party and third-party coverage components matter — and that the right policy structure depends on your business’s specific data exposure profile.

First-Party vs. Third-Party Coverage: Which One You Need

First-party cyber coverage pays for costs your business absorbs directly: breach notification, investigation, PR response, and business interruption if systems go down. Third-party coverage responds when affected parties come after your business legally — a client lawsuit, a regulatory enforcement action. In a vendor breach scenario, you often need both. Your direct costs come first (notification, investigation). Then come the downstream claims — a client who says the exposure damaged them, or a regulator who wants documentation that you responded appropriately. Most small business cyber policies package both. What varies is limits, sublimits, and exclusions. Not all policies cover vendor-triggered events equally. Some have explicit “contingent” coverage language for third-party vendor breaches. Some don’t. This is exactly the kind of policy language that matters when you’re filing a claim — and that most business owners never read until they need to.

The Real-World Scenario Spokane Business Owners Keep Getting Wrong

Picture a Spokane wellness practice with 300 clients. They use a cloud-based booking and intake platform — name of any of a dozen common ones — to manage appointments and collect client health intake forms. The platform gets breached. The vendor sends a notice. The practice owner forwards it to their office manager, figures the vendor will handle it, and moves on.

What they don’t do: contact an attorney to assess their notification obligations under Washington law. What they don’t know: those intake forms contain information that may qualify as personal health data under both state statute and HIPAA. What they find out later: they had 30 days to notify affected clients and potentially the AG’s office. They missed it.

The fine print of their BOP? No cyber coverage. No vendor breach language. The standalone cyber policy they were quoted two years ago and decided to skip? Would have covered the whole thing — attorney fees, notification costs, and the credit monitoring offer their clients were owed.

This is not a hypothetical. Versions of this happen to small businesses in Spokane every year. The vendors don’t always make it obvious what your downstream obligations are. That’s your job to know — and your broker’s job to help you prepare for.

What to Check in Your Current Coverage Before You’re on the Clock

Don’t wait for a vendor breach notice to find out where you stand. Here’s what to review now:

Your BOP or general liability policy. Look for any mention of “electronic data,” “cyber,” “data breach,” or “personal information.” Note any sublimits — a $10,000 sublimit on a $2 million GL policy is essentially no coverage for a real breach event.

Your vendor contracts. Does each vendor with access to your client or employee data have a written data processing agreement? Does it require them to notify you in a specific timeframe if a breach occurs? Do they indemnify you for their failures? Thin contracts create your problem. Solid contracts give you a legal path back to the vendor.

Your current cyber policy, if you have one. Look for “third-party vendor” or “contingent” coverage language. If it’s not there, ask your broker whether that coverage needs to be added.

Your list of vendors with data access. Most small business owners underestimate this number. Cloud email, scheduling, payroll, CRM, intake forms, storage — every one of those is a potential breach vector. The NAIC’s model law on cybersecurity specifically calls out third-party service providers as a coverage and risk management consideration.

If you want to sit down and run through your current policies to find the gaps, we’re happy to do that. No pitch — just a clear-eyed look at what you have, what applies, and what doesn’t. That conversation is a lot easier to have now than after a vendor sends you a breach notice on a Friday afternoon.

Get a quote or review your current coverage with All Lines Insurance here: All Lines Insurance

Frequently Asked Questions