Your Vendor Was Hacked. Could Your Business Be Liable?

When most small-business owners hear “data security,” they picture a major corporation, a sophisticated cyberattack, or millions of stolen credit-card numbers.

That isn’t the whole picture.

Every day, businesses in our industries collect and transmit information about customers, employees, vehicles, payments and transactions. Much of that information doesn’t remain inside the business. It passes through software companies, payment processors, financing providers, dispatch platforms, insurance systems, payroll companies, loyalty programs, cloud services and other vendors.

And that creates an important question:

When you give customer or employee information to another company, who is responsible for protecting it?

The answer may be closer to home than many business owners realize.

New York Places Responsibility on the Business, Too

New York’s SHIELD Act requires businesses that own or license computerized data containing New York residents’ private information to develop, implement and maintain reasonable safeguards to protect it.

Those safeguards aren’t limited to firewalls and passwords.

New York specifically identifies the selection and oversight of service providers as part of a reasonable data-security program. Businesses are expected to select providers capable of maintaining appropriate safeguards and require those safeguards by contract.

In other words:

Using a third-party company to handle information does not necessarily transfer your responsibility for protecting it to that company.

A vendor suffering a breach does not automatically mean your business violated the law. But if something goes wrong, one of the questions may be what reasonable steps your business took before entrusting that vendor with the information.

This Isn’t Just an Automotive Repair Issue

The information at risk looks different depending on the business.

RSGDA Member Resources:

RSGDA has developed industry-specific Know Your Vendors Checklists for:

• Automotive Service Shops
• Collision and Body Shops
• Towing Companies
• Salvage and Reclamation Services
• Convenience Stores, with and without fuel sales

Employee Information Counts, Too

Customer information gets most of the attention, but businesses should also consider what they maintain about employees.

Payroll, benefits, workers’ compensation, employment applications and HR systems can contain Social Security numbers, banking information, addresses, identification documents and other sensitive information.

Those records are frequently transmitted to outside payroll processors, insurance companies, benefits administrators, accountants and other service providers.

Your vendor review therefore shouldn’t stop at customer-facing systems.

Ask who has access to employee information as well.

What Does New York Consider Private Information?

The SHIELD Act covers specific categories of private information rather than every piece of information a business possesses.

Depending on how information is collected and combined, protected information can include Social Security numbers, driver’s-license and other identification numbers, financial account information, biometric information and online account credentials.

The law also expanded the concept of a breach beyond information actually being stolen. Unauthorized access to protected computerized data can potentially trigger the law as well.

The Vendor Breach Problem Is Already Getting Regulatory Attention

This isn’t a hypothetical concern.

In September 2026, the New York Attorney General announced a multistate settlement involving Labcorp following a breach at an outside debt-collection company.

The breach occurred at the vendor, but the resulting settlement required Labcorp to make substantial changes to its own vendor-risk management.

Those requirements included improving vendor oversight, minimizing data shared with vendors, strengthening contractual cybersecurity requirements, assessing and auditing vendors and developing procedures for responding to vendor security incidents.

The case involved a much larger organization and substantially more sensitive information than most independent businesses handle. But the underlying lesson translates:

Regulators are looking at what a business did to oversee the companies it trusted with customer information.

“We’re a Small Business” Doesn’t Mean “This Doesn’t Apply”

New York does recognize that reasonable cybersecurity for a small independent business will look different from cybersecurity at a national corporation.

The SHIELD Act allows safeguards to be appropriate to the size and complexity of the business, the nature and scope of its activities and the sensitivity of the information involved.

That’s important.

A ten-person repair facility isn’t expected to operate a Fortune 500 cybersecurity department.

But small businesses aren’t simply exempt.

The objective is reasonable protection appropriate to your operation.

Start With One Simple Exercise

You don’t need to become a cybersecurity professional.

Start by sitting down and answering this question:

Where does our information go?

Write down every outside company that receives, stores or can access customer or employee information.

Then ask:

• What information do they receive?
• Do they actually need all of it?
• How long do they keep it?
• Who else can they share it with?
• What security requirements are in our contract?
• How will they notify us if something happens?
• What happens to our information if we stop using them?

You may discover that information is being held in systems you haven’t thought about in years.

Collect Less. Keep Less. Share Less.

One of the simplest ways to reduce exposure is also one of the most overlooked:

Don’t maintain information you don’t need.

New York’s guidance encourages businesses to understand where consumer information is stored and dispose of private information within a reasonable period after it is no longer needed for business purposes.

That principle can be applied practically.

If an old vendor still has customer records from five years ago, ask why.

If software is collecting information you never use, ask whether it needs to.

If former employees still have accounts, remove them.

If everyone in the company uses the same login, change that practice.

If an outside provider has access to information it doesn’t need to perform its job, question the access.

Cybersecurity doesn’t begin with expensive technology.

It begins with knowing what you have, where it goes and who can reach it.

And Yes—Know Your Physical Vendors, Too

There is a parallel lesson on the product side.

NHTSA is currently warning the automotive industry about illegally imported DTN60DB replacement airbag inflators associated with deaths and serious injuries.

For businesses handling vehicles and safety-critical components, that raises another version of the same vendor-management question:

Do you know who you’re buying from?

Parts provenance matters. So does documentation.

But parts are only one piece of a much larger vendor-risk issue.

Whether you’re buying a safety-critical automotive component, hiring a payroll company, accepting payments through a processor, sending vehicles through an auction, using a towing dispatch platform or enrolling customers in a loyalty program, your business is placing some degree of trust in another company.

Know Who You’re Trusting

Most independent businesses couldn’t operate without third-party vendors.

The answer isn’t to stop using them.

It’s to understand the relationship.

Know which companies have access to your customers.

Know which companies have access to your employees.

Know what information you’re giving them.

Know what your contracts require.

Know how long the information is being kept.

And know what happens if something goes wrong.

Your vendor may operate the system.

Your customer still knows your business’s name.

That alone makes vendor security worth paying attention to.