← Back to news 06.10.2026

When your supplier shows up on a leak site

Ransomware groups publish the names of their victims, often before those victims' customers hear about it. If your payroll provider or cloud provider is listed there, an assessment begins for you that you cannot afford to wait out. What the GDPR requires of the processor, when your own deadline starts and which four questions should be answered in the first hour.

Extortion groups run their own sites where they name their victims, usually with a deadline after which the stolen data will be published. Public trackers collect these entries. For the companies named, that is bad enough. For their customers, it is often the first news that anything has happened.

Because the entry on the leak site often arrives before the supplier's email. The supplier has other worries in those days: restoring systems, commissioning forensics, talking to the insurer. The message to customers is further down the list, and its first sentence often says there are "currently no indications" of data exfiltration.

What the processor must do

If the supplier processes personal data on your behalf, the obligation is clear. Article 33(2) GDPR:

"The processor shall notify the controller without undue delay after becoming aware of a personal data breach."

And under Article 28(3)(f), the contract must stipulate that the processor assists you with the obligations under Articles 32 to 36, including your own notification. Both assume that the supplier knows what has been exfiltrated and has time to tell you. In the first days of an attack, neither is usually the case.

When your own deadline starts

Your obligation as controller is set out in Article 33(1). Notification to the supervisory authority is made

"without undue delay and, where feasible, not later than 72 hours after having become aware of it"

Having become aware, not: having been notified. Whether an entry on a leak site already means awareness of a breach depends on the individual case and on which data the supplier holds from you at all. Two things are certain: the assessment starts the moment you know about it. And under paragraph 5 you document breaches with all related facts so that the supervisory authority can verify compliance. Anyone who waited three days for the supplier's email will have to justify that later.

For entities under NIS2, the supply chain comes on top as a topic of its own: Article 21(2)(d) requires measures for supply chain security. What can be seen of a supplier's practice from the outside was covered in Practice shows from the outside.

Four questions for the first hour

Which data does the supplier hold from us? The data processing agreement and the record of processing show which categories of personal data and which data subjects are involved.
What access does the supplier have to us? Remote maintenance, VPN, service accounts, interfaces. Whatever an attacked service provider may do in your network, its attacker may do in those hours too.
What does the supplier say in writing? A documented request with date and time, asking about affected systems, data categories and the status of the investigation.
Who decides on notification? The data protection officer and information security belong at the table immediately, with the time of awareness noted.

None of these questions can be answered within an hour if the answers first have to be searched for. That is why they belong before the incident, in the supplier file, the contract and the record of processing.

How isidaten represents this

Leak site monitoring matches public ransomware trackers against a watchlist of your own organisations, suppliers, processors and ICT service providers. Each hit is assessed via the company's connections in the inventory: a processor with processing activities or a supplier with high criticality results in the level critical, and the reasons are recorded on the hit. For a supplier, a task with a deadline based on the risk level is created; for your own organisation, an incident of type ransomware, with the NIS2 deadlines running from awareness. An uncertain partial hit must be confirmed first before a task or incident is created.