# A supplier with access to our systems has been hacked. What do we do?

Close their door first, then ask questions. Suspend the supplier's accounts, VPN access and remote-support tools on your systems until they confirm what was affected, and rotate any shared credentials or API keys. Ask them in writing what happened and when, which of their systems were involved, whether your data or access details were exposed and which indicators of compromise they have, then search your logs for those indicators. Check what their access could reach: which servers, which data. Treat payment-related e-mails from them with caution, because stolen mail threads are reused for invoice fraud. If your data was exposed through them, you may have notification duties of your own. Review the contract for security and notification clauses. NetSenX flags beaconing and unusual sessions from hosts the supplier used, and its network map shows what those hosts actually talked to.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/a-supplier-with-access-to-our-systems-was-hacked

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Is it a compromised account or a compromised device, and why does it matter?](https://netsenx.com/en/faq/compromised-account-or-compromised-device)
- [What are the early warning signs of ransomware on a network?](https://netsenx.com/en/faq/what-are-the-early-warning-signs-of-ransomware-on-a-network)
- [Can network monitoring detect ransomware before encryption?](https://netsenx.com/en/faq/can-network-monitoring-detect-ransomware-before-encryption)
- [Does NetSenX stop ransomware?](https://netsenx.com/en/faq/does-netsenx-stop-ransomware)
- [What should we do first if we see these signs?](https://netsenx.com/en/faq/what-should-we-do-first-if-we-see-these-signs)