A supplier with access to our systems has been hacked. What do we do?
Close their door first, then ask questions. Suspend the supplier's accounts, VPN access and remote-support tools on your systems until they confirm what was affected, and rotate any shared credentials or API keys. Ask them in writing what happened and when, which of their systems were involved, whether your data or access details were exposed and which indicators of compromise they have, then search your logs for those indicators. Check what their access could reach: which servers, which data. Treat payment-related e-mails from them with caution, because stolen mail threads are reused for invoice fraud. If your data was exposed through them, you may have notification duties of your own. Review the contract for security and notification clauses. NetSenX flags beaconing and unusual sessions from hosts the supplier used, and its network map shows what those hosts actually talked to.