How Should Small Businesses Audit Vendor Risk After the August 2026 Healthcare and Retail Breaches?

What actually happened in August 2026, and which numbers hold up?

Last week, on August 25th, Boston Scientific detected unauthorized activity on their systems and went offline. The outage stopped manufacturing and halted the processing and shipping of customer orders worldwide. The company brought in CrowdStrike, stated the activity was limited to on-premise systems, and reported no impact to its cloud-based applications. Customers have been allowed to submit electronic orders, but those orders are still sitting in a queue. Shipping began returning about a week later. In a September filing, the company said it no longer expected to meet its third-quarter and full-year 2026 forecasts, and it plans an update when it reports results on October 28. Reporting to date does not name an attacker.

Also last week, McKesson disclosed an incident they discovered on August 25th. The company has confirmed unauthorized access to third-party applications and data exfiltration tied to a subset of customers in its Oncology and Multispecialty and Medical-Surgical units. Over the weekend, the extortion group ShinyHunters says it phoned employees, took over single sign-on accounts, and moved into Salesforce and Snowflake. The group claims about 1 terabyte of data, 284 million records, and a ransom demand of $55,236,150. McKesson has not yet responded to these claims. Treat the 284 million as database rows, not people. Have I Been Pwned counted 6.4 million unique email addresses in the data the group published. McKesson also told customers it was still shipping orders.

But that’s just last week. Many more incidents happened in August, and most companies are oblivious to their risks. Carhartt, the work apparel company was listed by ShinyHunters August 13 and claimed more than 50 gigabytes of customer and employee data. Have I Been Pwned verified 12,933,413 accounts on August 26 after removing millions of synthetic records. The exposed information was email addresses, names, phone numbers, and physical addresses of customers and employees. Researcher Troy Hunt linked the data to a Databricks analytics environment. Carhartt has not publicly confirmed the breach.

These are separate events. One was an on-premise network intrusion that stopped production. The other two were data theft from cloud platforms, and ShinyHunters claimed both. No single wave connects them, yet each one left customers waiting, with no control, on a supplier’s answers.

Why does a vendor breach become your problem within 60 days?

If you run a medical practice, patient data lost by a vender can create duties for you, even though you did nothing wrong. The[https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html)HHS Breach Notification Rule requires individual notice without unreasonable delay and no later than 60 days after discovery. McKesson said it expects to offer credit monitoring and a support line, but it has published no count of affected people. A practice that waits for a final number can lose weeks it does not have. Ask counsel when your own clock starts, because it depends on when you learn of the breach.

Boston Scientific shows the operational side. Its customers can place orders but they sit un-processed. Nobody knows when they will clear the backlog. A small buyer has little pull in making shipments happen. Few practices can switch devices in days, so the useful question is how long you can operate without the supplier.

The third risk lands in your inbox and on your phone, and it frightens me most. The contact details of 12.9 million Carhartt accounts are public. McKesson’s alleged entry point was a phone call to an employee. Attackers who hold names, addresses, and order histories can pose as a vendor and ask your accounts payable team to change bank details. They can also call your help desk to reset a login. None of these attacks needed to touch a small business directly to hurt one.[https://www.cisa.gov/topics/cybersecurity-best-practices](https://www.cisa.gov/topics/cybersecurity-best-practices)CISA’s guidance on social engineering explains how these pretexts work.

How to score vendors from 1 to 5 and demand 72-hour breach notices

Work through the following four steps, in the order outlined:

List every supplier that holds your customer or patient data, then list the ones you cannot operate without.

Score each supplier from 1 to 5 on data sensitivity, and again from 1 to 5 on how long replacement would take. Review anything scoring 4 or higher first.

Send each high scorer a short questionnaire. Ask for a current SOC 2 report and written proof that single sign-on requires phishing-resistant multifactor authentication. Require breach notice within 72 hours.

For any supplier scoring 5 on replacement time, name a backup source and plan for a supply gap of at least two weeks.

The second request in step 3 matters most right now. McKesson’s reported breach started with stolen single sign-on access, so a vendor that cannot show multifactor enforcement is telling you something. The[https://www.ftc.gov/business-guidance/small-businesses/cybersecurity](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity)FTC’s small business cybersecurity guidance offers a plain-language baseline for these conversations.

How do you check staff credentials in 60 seconds and close the vishing gap?

Your suppliers are only half the picture, and the other half is where this problem hit home for us. Customer breaches like Carhartt’s publish email addresses, and attackers test those addresses against other logins. Large enterprises have teams watching for that. Most small businesses have nobody, and that gap is why we built Identity Defense 247. It scans your company domain against live threat sources and returns the number of exposed credentials in about 60 seconds, with no sales call. A real estate brokerage with 45 agents ran the scan across its whole roster and found 19 exposed credentials tied to an old LinkedIn breach. The managing broker started a mandatory reset using the automated action plan and hired no outside consultant.

Pair the scan with one phone rule. Any request to reset a password, approve a login prompt, or move multifactor authentication to a new device gets verified by calling back a number already on file. Vishing works because the caller sounds like a colleague. A callback costs two minutes and breaks the script.

Run the scan monthly. Exposure changes as new breaches surface, and Identity Defense 247 supports that cadence through Continuous Monitoring.

What should you do in the first 24 hours after a vendor breach?

Most small businesses have no plan for the day a supplier’s breach notice arrives, so write yours now. Move in four windows:

Hours 0 to 2: Confirm the breach on the vendor’s official notice page, not through an emailed link, because scammers exploit breach headlines. Name one owner and start a timestamped log.

Hours 2 to 6: List what the vendor holds on you, such as patient records, payment details, and portal logins. Freeze bank detail changes and apply the callback rule to every invoice.

Hours 6 to 12: Reset shared vendor portal passwords and confirm multifactor authentication on every account that touches the vendor. Scan your domain with Identity Defense 247 to see whether staff credentials appear in new exposure data.

Hours 12 to 24: If patient data may be involved, call counsel so the HIPAA timeline starts correctly. Check your cyber insurance policy for its notice window and report the event if required. Warn staff to expect fake vendor calls and refund emails, and contact your backup supplier.

I did not expect these breaches to change what we build, but they did. The targets were large companies, and small businesses still carry the cost. Everything we publish next starts from that problem.