Security in order, yet your data on the dark web: how is that possible?

You monitor your environment. The rights are well arranged, logging is on, detection does its job. And one day you hear the message that all those measures should have been prevented: "Sensitive organizational data is out in the open." How is that possible? 

The answer is as simple as it is worrying: a data breach does not have to occur with you at all. Your organization is part of a chain: you share data with suppliers, processors and partners. If something goes wrong there, it happens out of your sight. 

Whether and when you will hear something like this remains to be seen. Sometimes a chain partner informs you, sometimes you hear about it through the media. In both cases, you are behind the times. And did you know that you can be held responsible for this in the meantime? 

Leak at your partner, damage to you 

Contracts with price agreements, sensitive customer or patient data, technical drawings of a product you still want to make: when a chain partner has a data breach, your data can just end up on the dark web. 

What consequences can this have? 

• Loss of competitive advantage 
  Are your price agreements made public? Or is there information circulating about your product in development? Then someone else will negotiate with your data in hand from now on. 

• Blackmail 
  Have personal data of customers or patients been stolen? Then malicious parties can approach them directly and put pressure on them. 

• Image damage 
  Are you making headlines because of an incident in a system that you have never logged in to? That doesn't matter for your reputation. Trust in your organization has still been damaged. 

How far-reaching can a data breach be? Two practical examples 

In 2023, hackers broke into Nebu, a software provider of market research firms that conduct customer satisfaction surveys on behalf of other companies. Through this chain, personal data of customers of various organizations may have been made public. At least 139 organisations reported to the Dutch Data Protection Authority, including NS, VodafoneZiggo and CZ. 

Their own systems had not been hacked. And Nebu was not even a direct supplier for many of these organizations, but the supplier of their supplier. A clear example of how far a data breach can extend through the chain. 

That same year, the extortion group Cl0p exploited a vulnerability in MOVEit Transfer, software for the secure exchange of files. It was a zero-day (CVE-2023-34362): data was already captured before a security update was available. According to Emsisoft, 2,773 organizations and more than 95 million people were ultimately affected. 

Many organizations didn't hear about it from their vendor, but didn't discover it until their name appeared on Cl0p's leak site. 
 

NIS2: your chain, your choices, your responsibility 

Under NIS2, which has been in force in the Netherlands since 15 August 2026 via the Cybersecurity Act (Cbw), the security of your chain is also an important part of your responsibility. 

Does your organization fall under the CBW? Then you must demonstrably take appropriate measures to manage the cyber risks of suppliers and partners that affect your services, systems or data. In concrete terms, this means that you know which parties are critical, set appropriate security requirements, record agreements contractually, assess risks and be prepared for incidents at suppliers. 

Are you not covered by the Cbw yourself? Then you may still have to deal with these requirements through customers who do fall under the law. 

Are you working with a party that does not have its security in order? Then you have chosen that party. If a cyber incident follows, you can be held accountable for the measures and considerations you have made yourself. 

Therefore, determine when a partner must report an incident to you. And take a closer look at parties that are located outside the EU or do not fall under NIS2. Because in the unlikely event of a cyber incident, you may never get that crucial phone call from them. 
 

Identify possible data leaks before your chain partner calls? 

With Wortell's Darkweb Monitoring, you can reverse the order. Do your domain names, business email addresses, or login credentials appear in leaked datasets, on dark web forums, or on leak sites? Then we can signal this and you will receive a notification. 

This allows you to discover a possible data breach at an early stage, sometimes even before your chain partner reports to you. That gives you the space to act in a targeted way. Think of resetting leaked credentials, revoking active sessions, or scaling up an incident internally. 

Because as the MOVEit example shows, it is by no means self-evident that you will be the first to hear from your supplier that your data has been stolen. By monitoring outside your own IT environment, you increase the chance that you will discover where your data is popping up in time.