One Breach, 32 Notices: How Vendor Cascades Multiply Breach Risk in California

Your breach is often someone else's breach

The most important pattern in California's data-breach record is not a single dramatic hack. It is the quiet way one incident at a shared service provider turns into notification obligations for dozens of downstream organizations at once.

intSignal Research found this directly in the state Attorney General's register by sorting notices by shared breach-date signatures. A single third-party incident dated February 21, 2024 produced Attorney General notices from 32 distinct organizations — pharmaceutical manufacturers and patient-assistance programs, all notifying after an incident at a shared distribution and services provider. It was not the largest example, only the clearest:

• October 29, 2023 — eight life insurers and retirement-plan providers filed notices after an incident at a shared benefits-platform vendor, plus six notices from the vendor itself.
• November 1, 2024 — 14 California community health centers tied to shared administrative infrastructure.
• December 13–16, 2024 — nine affiliated California radiation-oncology practices.
• May 30, 2023 — organizations downstream of the mass file-transfer-software exploitation that defined that year.

The frequent notifiers are vendors, not brands

Look at who files the most notices and the same story appears. The most frequent notifiers in the register are data processors and administrative vendors rather than consumer brands: one healthcare data-services firm filed ten notices in the window, a business-process outsourcer nine, a debt-collection services firm nine, a benefits administrator seven, and an insurance-platform vendor six.

For any California business, the register's plain message is that your breach is frequently someone else's breach — your payroll processor, benefits administrator, billing vendor, or software provider — and your notification obligations attach regardless of where the failure occurred.

California's data confirms the national trend

This is not a California quirk. In Verizon's 2026 Data Breach Investigations Report, third-party involvement reached 48 percent of breaches, a 60 percent increase over the prior year's 30 percent — the fastest-growing structural risk in the dataset. The register simply lets you watch the same dynamic play out in California's own notification record, incident by incident.

The DBIR also names the gap that makes cascades so damaging: only 23 percent of third-party organizations had fully remediated missing multi-factor authentication on cloud accounts. The weakest link in a supply chain is frequently an access-control basic left undone at a vendor you have never audited.

Vendor risk management with teeth

The cascades justify treating vendor risk as an operational control, not a questionnaire exercise:

• Keep a current inventory of every vendor that holds your company or customer data. You cannot assess exposure you have not enumerated.
• Contract for breach notification shorter than the statutory maximum, so a vendor incident reaches you in time to meet your own SB 446 obligations.
• Verify, don't self-attest. Confirm vendors' MFA and access controls rather than accepting a checked box — the DBIR's 23 percent figure is what self-attestation misses.
• Remember you are also the third party. For your larger customers, your security posture is now a condition of doing business. The same controls that protect you make you a vendor others can keep.

All four produce the same artifact: a current record of which vendors hold your data, what you verified, and when. That is also what a SOC 2 or ISO 27001 auditor asks to see, which is why vendor reviews are worth filing as control evidence — in an encrypted compliance evidence vault rather than a spreadsheet on one person's laptop.

Downstream, an incident you did not cause still lands as your notification duty and your customers' lost trust. The businesses that weather cascades are the ones that mapped their vendor exposure before an unfamiliar breach date showed up in the register with their name attached to it.

The figures in this article are drawn from the California Cybersecurity Risk Report 2027 by intSignal Research, where each is traced to its source, method, and limitations, and the full breach-register capture and analysis scripts are published for independent verification.