# Vendor Breach Readiness Kit

This kit helps a small business get ready for the day a trusted vendor is breached, and to hit the patch deadlines that are live this week. It covers the incidents reported around Amadeus, the OpsShield and cPGuard update channel, mSecure and Frontline, plus the CISA Known Exploited Vulnerabilities (KEV) items for WordPress Core, Ivanti Connect Secure and Barracuda. Print it, fill it in, and keep a copy somewhere that doesn't depend on the systems you're protecting. It is general information, not legal or security-consulting advice.

## Checklist

- [ ] Build the vendor inventory (worksheet 1): every hosting panel, plugin, SaaS app, payment, booking, email, payroll and IT provider.
- [ ] For each vendor, record what customer or employee data it holds and who the contact is.
- [ ] Apply the WordPress Core fix tied to CVE-2026-119977 (due 2026-11-06).
- [ ] If you run Ivanti Connect Secure, patch for CVE-2026-118527 (due 2026-11-13) and have someone check the device for signs of compromise.
- [ ] If you run a Barracuda Email Security Gateway, apply the patches for CVE-2026-116606 and CVE-2026-111560 and get written confirmation from your IT provider.
- [ ] Review every plugin or panel that can auto-update unattended: who controls the update channel, is there a rollback backup, are there unexpected files or admin users.
- [ ] Rotate credentials stored on any server that ran an auto-updating security plugin.
- [ ] Rotate passwords and turn on multi-factor at any vendor that has reported an incident; stop reusing passwords across vendor portals.
- [ ] Split shared logins so one vendor breach does not expose several accounts.
- [ ] Reduce freelancer and contractor admin access to the minimum, with an end date.
- [ ] List every permission your AI assistants and automation tools hold, and cut them to the minimum.
- [ ] Write the one-page vendor-breach response plan (worksheet 4) and name its owner.
- [ ] Choose the 3 vendors with the most sensitive data and ask for a breach-notice clause at next renewal.
- [ ] Ask your insurer what a vendor-caused breach requires of you, and note the claim contact.

## Worksheet 1: Vendor inventory

Copy this table for each vendor, or use one row per vendor in a spreadsheet.

```text
Vendor name:
What it does for us:
Data it holds (customer / employee / payment / health / other):
Approximate number of records:
Access level (who at our business can log in; any outside users):
Vendor breach contact (name, email, phone):
Auto-update on? (yes/no)  Who controls the update channel:
Breach-notice clause in contract? (yes/no)
Sensitivity rank (1 = highest damage if breached):
Notes:
```

## Worksheet 2: KEV and patch-deadline tracker

| Item | Identifier | Deadline | Do we run it? | Patched (date) | Checked for compromise (date, by whom) |
|---|---|---|---|---|---|
| WordPress Core | CVE-2026-119977 | 2026-11-06 | | | |
| Ivanti Connect Secure | CVE-2026-118527 | 2026-11-13 | | | |
| Barracuda ESG | CVE-2026-116606 | no KEV date given; patch released | | | |
| Barracuda ESG | CVE-2026-111560 | no KEV date given; patch released | | | |

Also watch the other recent KEV additions named in the desk briefs: Ivanti Connect Secure (a second flaw), GitLab, Cisco ASA/FTD and VMware ESX. Add a row for any you run. A patch closes the door; it does not tell you whether someone already came through, so record who checked and when.

## Worksheet 3: Plugin and auto-update review

For each plugin or panel that can update itself:

```text
Name and version:
Does it auto-update? (yes/no)
Who runs the update channel (vendor name):
Last update date:
Backup taken before last update? (yes/no, where)
Unexpected files or admin users found? (yes/no, what)
Credentials stored on this server (list, so you can rotate them):
Decision: leave automatic for security fixes / stage first / manual only
```

## Worksheet 4: One-page vendor-breach response plan

Fill in and keep this where you can reach it without logging in to anything.

```text
RESPONSE OWNER (name, phone, backup person):
Who calls the vendor (name, phone):
Vendor contact list location:
Hour 0 to 4: confirm what the vendor says happened; write down the time we learned.
Hour 4 to 24: use worksheet 1 to list which of our data fields the vendor held and how many people.
Hour 24 to 48: rotate passwords and keys for that vendor; turn on multi-factor; revoke unneeded access.
Hour 48 to 72: decide who must be told (customers, employees, regulators, insurer) and draft notices.
Insurer and claim line:
Attorney (name, phone):
Who writes customer notices:
Where we keep a copy of this plan:
```

## Worksheet 5: AI-assistant permissions audit

```text
Tool or assistant:
What accounts or files it can read:
What it can send (email, messages, posts):
What it can delete or change:
Who approved this access and when:
Minimum access it actually needs:
Action: remove / restrict to read-only / keep with logging
```

## Template: customer notification (starter)

```text
Subject: A security incident at one of our service providers

Hello [name],

We are writing to tell you that [vendor name], a company we use for [what it does], has reported a security incident. We learned about it on [date].

What we know: [one or two plain sentences from the vendor's notice].
What information of yours may be involved: [list only what you have confirmed, such as name, phone number, appointment reason].
What we are doing: [steps from your plan, such as changing access and asking the vendor for details].
What you can do: [for example, watch for suspicious messages and change reused passwords].

We will update you by [date]. Questions: [contact name, phone, email].
```

Have a lawyer check any notice for legal timing and content requirements before sending.

## Template: employee notification (starter)

```text
Subject: Action needed: a vendor we use reported a security incident

Team,

[Vendor name] reported an incident on [date]. Please change your password for [list tools] today, turn on multi-factor if you have not, and do not reuse that password anywhere else. Report anything odd to [name] right away. We will share more on [date].
```

## Contract clause starter list (for a lawyer to review)

- Notice to us within 72 hours of the vendor becoming aware of a breach affecting our data.
- A named security contact at the vendor, kept current.
- A description of what data was accessed, in what systems and when.
- Cooperation with our investigation and our regulators.
- A list of sub-processors and notice when it changes.
- Our right to receive or delete our data when the contract ends.
- Notice and testing procedures for changes to automatic update channels that touch our systems.

## Prompts

Paste your own documents or lists in place of the brackets. Each prompt asks the AI to say when it's unsure.

```text
I run a [type of business] with [number] employees. Below is my list of software vendors and what each handles. Work only from this list; do not assume anything about a vendor I haven't written down.

[paste vendor list]

Rank the vendors by how much damage a breach at each would do to my customers. Flag which hold regulated or sensitive data and explain which field in my list drove each ranking. Give me a table I can act on. If my list is missing information you would need, say so rather than guessing.
```

```text
Draft a one-page vendor-breach response plan for a small business. Include: who owns the response, a 72-hour checklist, a customer notification template in plain language, questions to ask the vendor, and when to call my insurer and an attorney. My business: [describe]. My vendor inventory: [paste]. Say clearly where you are unsure or where laws vary, and tell me to have a lawyer check legal notice deadlines.
```

```text
I use [hosting panel / plugin / VPN / email gateway] at version [version]. Explain in plain English what "known exploited vulnerability with a patch deadline" means for me, how to find out whether my version is affected, how to apply the fix safely with a backup first, and how to check for signs I was already compromised. Use only this advisory text: [paste]. If the advisory doesn't answer something, say it is unclear and tell me who to ask.
```

```text
Write a short breach-notification and security clause I can ask a SaaS vendor to add to our contract: 72-hour notice, a named contact, a description of the data accessed, and cooperation with an investigation. Keep it readable by a non-lawyer. Compare against my current contract text: [paste]. Point out conflicts, say where you are unsure, and remind me to have a lawyer review it.
```

```text
Here are the permissions my AI assistant and automation tools currently have: [paste]. Treat each as a privileged account. Tell me what each can read, send and delete based only on what I pasted, then which to remove, which to restrict to read-only, and how to log what it does. If a permission is too vaguely described to judge, say so and tell me where in the tool's settings to look.
```

## Sources

- https://apprised.news/desk/tech/2026-11-05
- https://apprised.news/desk/tech/2026-11-04
- https://therecord.media/asian-airlines-announce-data-breach-it-provider-incident
- https://www.csoonline.com/article/4244961/attackers-turned-opsshields-trusted-update-channel-into-a-supply-chain-attack-2.html
- https://www.bleepingcomputer.com/news/security/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data/
- https://securityaffairs.com/202440/security/two-barracuda-esg-flaws-could-be-combined-for-full-root-access-patches-released.html
- https://thehackernews.com/2026/11/msecure-warns-users-to-change-passwords.html
- https://www.securityweek.com/frontline-education-data-breach-impacts-over-1-3-million/