Who Pays When Your Vendor Leaks Your Client Data? The Clause Berks & Lancaster Businesses Never Read
If a payroll processor, billing platform, HR system, software provider, or outsourced IT company exposes your client data, who pays?
Most business owners answer: the vendor.
That answer may be wrong.
When a third-party vendor causes a data breach, the contract often decides how much responsibility stays with the vendor, and how much comes back to your business. Your clients may call you. Regulators may question you. Your insurer may review your vendor oversight. But the vendor’s contract may limit its responsibility to the amount you paid over the last 12 months.
For a $200-per-month software platform, that could mean a liability cap of just $2,400.
That is not a theoretical concern for businesses in Reading, Wyomissing, Lancaster, Lititz, and throughout Berks and Lancaster counties. Third-party relationships are now a major part of the business risk landscape.
According to the Verizon 2025 Data Breach Investigations Report, third-party involvement in breaches doubled from 15% to approximately 30%. A separate Black Kite analysis of 2025 third-party breach events found that each breached vendor compromised an average of 5.28 downstream organizations. The average time between discovery and public disclosure was approximately 117 days.
That means your exposure may begin long before you know there is a problem.
The vendor owns the system. You still own the relationship.
Your client data may live in someone else’s cloud. Your employees’ information may be stored in someone else’s payroll platform. Your billing records may pass through a software provider headquartered outside Pennsylvania.
But when that information is exposed, your clients generally do not know, or care, which technology company failed.
They call your office.
A Reading accounting practice may have trusted its payroll provider to protect employee tax information. A Wyomissing manufacturer may rely on a third-party HR platform for employee records. A Lancaster professional services firm may use a cloud billing platform containing client names, addresses, payment details, and project information.
The vendor may have caused the incident, but your company may still face:
- Client notification and communication costs
- Legal review and regulatory inquiries
- Forensic investigation expenses
- Disruption to billable work
- Contract disputes with affected customers
- Loss of trust and reputational damage
- Questions from your cyber insurer about vendor oversight
The key question is not only, “Who caused the breach?”
It is also: “What did the contract say before the breach happened?”
The clauses that quietly transfer risk back to you
Vendor agreements are often written to protect the vendor’s business first. These clauses deserve particular attention.
1. The liability cap
A common limitation says the vendor’s total liability is capped at the fees paid during the previous 12 months.
If you pay $200 per month, the vendor may argue that its maximum exposure is:
$200 × 12 months = $2,400
Now compare that with a $250,000 loss involving investigation, legal work, notification, lost capacity, and client claims.
The contract may technically provide a remedy while making that remedy financially insignificant.
Look for whether the cap applies to:
- Privacy or security incidents
- Confidentiality violations
- Data loss
- Regulatory penalties
- Indemnification obligations
- Negligence or willful misconduct
A stronger agreement may exclude security and privacy events from the general cap or create a separate, higher “super-cap.”
2. Consequential or indirect damages exclusions
These exclusions may prevent you from recovering losses such as:
- Lost revenue
- Lost profits
- Business interruption
- Loss of goodwill
- Client claims
- Costs caused by delayed operations
That matters because the largest cost may not be the forensic bill. For a professional services firm, the larger loss may be lost capacity: staff pulled away from client work, delayed filings, missed deadlines, and time spent answering questions.
The Verizon 2026 Breach Impact Study found that business interruption represented approximately 50% of known losses in supply-chain and third-party incidents.
If the contract excludes those losses, the vendor may have little financial responsibility for the disruption its failure creates.
3. “As-is” warranties
An “as-is” provision may mean the vendor makes limited promises about the platform’s security, availability, or suitability.
That does not automatically make the vendor careless. It does mean you should not assume the agreement guarantees a particular level of protection.
If the vendor handles sensitive information, the contract should address specific safeguards rather than relying on general language about reasonable security.
4. No obligation to indemnify you
Indemnification is the section that may require one party to defend or reimburse the other for certain claims and losses.
Some vendor contracts provide no meaningful indemnity for:
- Unauthorized access
- Privacy violations
- Failure to protect confidential information
- Regulatory investigations
- Claims brought by affected clients
Without appropriate indemnity language, you may be left paying expenses associated with a vendor-caused event, even when the vendor’s systems were the point of failure.
5. Vague breach-notification language
“Promptly” is not a useful incident notification deadline.
Neither is “within a reasonable time.”
Your business needs enough time to investigate, involve counsel, notify clients, assess regulatory obligations, and coordinate with your insurer. A contract should establish a defined window, such as notification within 24, 48, or 72 hours after the vendor confirms a security incident involving your data.
The agreement should also explain what information the vendor must provide and how often it must update you.
6. No security addendum
A standard master services agreement may say almost nothing about:
- Multi-factor authentication
- Encryption
- Access control
- Logging and monitoring
- Security testing
- Employee training
- Data retention and deletion
- Incident response
- Evidence of insurance
A security addendum turns broad expectations into written obligations.
7. Broad subprocessor rights
Your vendor may not be the only company handling your information.
A subprocessor could provide hosting, analytics, support, storage, payroll services, or payment processing. If the agreement lets the vendor appoint subprocessors without notice or approval, your data may move down the chain without your knowledge.
You should know:
- Who the subprocessors are
- What information they receive
- Where they operate
- What security requirements apply to them
- Whether you receive notice before they are added
- Whether you can object or terminate if the risk changes
The financial exposure is larger than the contract may suggest
External liability losses often look modest when viewed at the median. The Verizon Breach Impact Study found a median external liability loss of approximately $22,000.
But the tail reached beyond $4 million.
That difference is important. A median is not a budget. It is not a maximum. It does not tell you what happens when a breach affects highly regulated data, a large client base, or a business that cannot operate normally while systems and records are investigated.
B&R’s business risk benchmarks also point to the broader exposure:
- Approximately 43% of attacks target small and midsize businesses.
- Average breach costs can exceed $200,000.
- Approximately 60% of businesses do not survive six months after a major breach.
- Human error is involved in roughly 74% of breaches.
These figures are not a substitute for analyzing your own business. They are a reminder that vendor risk belongs in the financial risk conversation, not only the IT conversation.
Insurance does not replace contract review
Cyber insurance may respond to some costs. However, insurers increasingly ask how an organization manages vendor risk during underwriting and renewal.
Your insurer may ask whether you:
- Inventory vendors that handle sensitive information
- Review vendor security controls
- Require written security obligations
- Collect certificates of insurance
- Review vendor liability caps
- Require incident notification within a defined timeframe
- Monitor high-risk vendors over time
A contract that caps the vendor’s responsibility at $2,400 will not prevent an insurer from asking why your business accepted that exposure.
Regulated businesses should pay particular attention. The FTC Safeguards Rule requires covered financial institutions to conduct risk assessments, oversee service providers, include security expectations in contracts, and periodically reassess those providers. The FTC’s Safeguards Rule guidance also makes clear that using a service provider does not transfer away the company’s responsibility for its information security program.
HIPAA-covered organizations face similar expectations when vendors handle protected health information. A business associate agreement is not a substitute for due diligence, contract review, or ongoing oversight.
A practical vendor contract review checklist
Give this checklist to the person responsible for contracts, compliance, finance, or operations:
- Inventory every vendor that touches client, employee, financial, health, or confidential business data.
- Rank vendors by impact, considering the sensitivity of the data and how difficult it would be to operate without the service.
- Pull the actual agreement, including exhibits, terms of service, data processing agreements, and security addenda.
- Read the liability cap and calculate the dollar amount using your actual fees.
- Review indemnity and damages exclusions, especially for privacy incidents, business interruption, and client claims.
- Confirm the breach-notification deadline and require a specific timeframe rather than “promptly.”
- Ask for a written security addendum requiring MFA enforcement, access controls, encryption, monitoring, and incident cooperation.
- Review subprocessor language and require notice before your data is shared with additional providers.
- Request current evidence, such as a SOC 2 report, penetration test summary, security questionnaire, and certificate of cyber insurance.
- Document the review so you can demonstrate the decision to an insurer, regulator, client, or board.
You do not need to renegotiate every contract at once. Start with the vendors that could create the greatest financial, regulatory, or operational damage.
The contract is part of your security control environment
A vendor’s security program matters. So does your contract with that vendor.
Risk management means identifying the exposure, estimating the impact, reducing the risk where possible, and monitoring it as the relationship changes. That applies to a payroll provider in Wyomissing, a billing platform serving clients in Lancaster, or a software vendor supporting a manufacturer near Ephrata.
Start by reviewing the agreements you already signed. Then use the findings to improve your next contract.
For more practical guidance, visit B&R Computers’ business risk resources or attend the Thursday General Cyber Briefing.
If you want help determining which vendor relationships create the greatest exposure, schedule a confidential Business Risk Review and Strategy Session. B&R Computers can help you identify the risks, quantify the potential business impact, and build a documented plan for improving your vendor risk program.