Report: 48% of 2026 breaches involve third parties

Verizon's 2026 DBIR puts third-party involvement in confirmed breaches at 48%, up 60% year over year. IBM's Cost of a Data Breach 2026 says breaches starting at an infected supplier take 258 days to identify and contain versus 247 on average. Examples include the Telus Digital chain via Salesloft Drift and the LiteLLM poisoning.

• Verizon DBIR 2026: 48% of confirmed breaches involve third parties
• IBM: supplier-origin breaches take 258 days to contain vs 247 average
• LiteLLM attack lasted ~40 minutes and hit about 2,500 organizations
• The Telus chain reused credentials from the Salesloft Drift breach