Your supplier was hit by ransomware: what to do

Why is your name not on the victim list, but maybe in the files?

A ransomware group usually names the company it attacked on its own website and, if the company does not pay, publishes the files it took from it. Those files are the victim’s: invoices, contracts, purchase orders, e-mails, lists of customers and suppliers.

If you work with the victim, you appear in them. Your company name, your domain or your staff’s e-mail addresses can sit in a contract, a payment reminder or a mailing list. Your company was not attacked, so it is not on the list. It can still be in the files, and the list does not tell you.

What does OwlyScan’s own count show?

We counted once, on one publication. In the files of one business-services supplier, published by a ransomware group in 2026, 99 of the 104 large groups on our list appear by their e-mail or web domain. The count dates from 10 November 2026. We name neither the supplier nor the groups.

This does not say those groups were attacked: the supplier was. It does not say how much there is about each group either. It is one publication, so it is a case and not a rate. How we counted.

What should you ask the supplier in the first days?

Put the questions in writing, to your usual contact and to its security or data protection lead. Keep the answers and their dates.

1. What was reached? Which systems and files, and since when.
2. What does it hold about you? Contracts, documents, personal data, access details shared with you.
3. Was anything published? Whether the attackers put files online, and whether the supplier has seen them.
4. Who has been told? Its authority, its insurer, its other customers, and on what date.
5. What is closed? The entry point, the passwords and keys, and whether an independent report will follow.
6. Who is your contact, and when is the next update?

How do you search for your own company?

Open the free search and type your company name, then your domain. No account is needed. It tells you how many documents match and what kind they are, with names hidden. You do not read their text. How the free search works.

Access is a subscription for your company. It shows the records about your own domain as they are, keeps other companies’ names hidden, and connects your own AI assistant to the same data through MCP, a standard way to link an assistant to a data source. What Access gives you.

A search with no result is not proof that you are absent. A name can be spelled another way, a document can be missing from our index, and a group can publish later. Search again in a week or two.

When do you have duties of your own?

This is general information, not legal advice. Ask your data protection officer or a lawyer how it applies to you.

• GDPR. If the supplier handles personal data on your behalf, the GDPR sets that it informs you without undue delay after becoming aware of a personal data breach (Article 33(2)). You, as the controller, notify the breach to your supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it, unless it is unlikely to result in a risk to people’s rights and freedoms (Article 33(1)). Even when you do not notify, you document the breach (Article 33(5)). In France the authority is the CNIL (page in French).
• NIS2. The directive asks Member States to make essential and important entities take risk-management measures. They include supply chain security, with the security aspects of the relationships with direct suppliers (Article 21(2)(d)). If you are in scope, the detail is in your national law. NIS2 on OwlyScan.
• DORA. If you are a financial entity in scope, you manage the risk of your ICT third-party providers as part of your ICT risk management (Article 28). DORA on OwlyScan.

A short checklist

1. Write to the supplier today with the questions above.
2. Search your company name and your domain in the free search, and note the date.
3. Change the passwords and keys you share with the supplier, and review the access you gave it.
4. Ask your data protection officer whether personal data, yours or your customers’, is involved, and write down when you became aware of it.
5. Read your contract: notification clauses and audit rights.
6. Search again in a week or two.

Questions people ask