Vendor breach with no contract language

Order matters because each step depends on facts the previous one produces.

1. Freeze and preserve. Demand in writing the vendor's incident timeline, the affected bucket identifier, access logs, and whether data was exfiltrated or merely exposed. Logs expire; get them before the vendor's retention window closes.
2. Establish the factual scope internally. Confirm the 3,400 licence images were in scope, which customers are affected, and whether the 90-day deletion rule would have removed them. A foreseeable, policy-violating retention produces a materially worse legal position than an unavoidable exposure, so this fact drives everything downstream.
3. Hand the notification decision to legal, not security. Duty to notify turns on jurisdiction and on whether licence numbers are ordinary personal data or a special category. The security manager supplies facts, exposure estimates and containment status; counsel decides. Do not let engineering send the customer letter.
4. Put the vendor on notice - written instruction to preserve data, no deletion, and a named contact.
5. Only then draft communications. A premature 'no evidence of misuse' statement becomes the exhibit that is read aloud later.

Do not attempt to forensically review the vendor environment. You have no audit right, which is exactly the gap that gets closed at renewal.

Risk ownership: contractually, essentially none of it was transferred. With no security schedule, no notification clause and no audit right, Halden retains the risk of a supplier it cannot inspect or compel. The vendor's breach was the trigger; Halden's contract is the cause. Write it that way in the legal memo - calling it 'vendor risk' implies the vendor holds it, which is comforting and false.

The mismatch is arguably worse than the breach. Halden classified licence images as Restricted, then never enforced the 90-day deletion on data held by a third party. That is an internal control failure, not a vendor failing, and it will be the first question asked by any regulator.

Fix it at the source rather than by adding a clause:

• Stop new collection. Does a freight broker need a scanned licence image, or only an expiry date and a verification result? The strongest retention control is not collecting the artefact.
• Purge existing images within a defined window, subject to legal hold on the incident set.
• Add a technical lifecycle rule to the storage location so retention is enforced by configuration, not by policy PDF.

Sequence: stop collection, purge, then contract remediation at renewal.

Each pick maps to something that actually failed.

1. Breach notification with a clock and content specification. Notify within 24-48 hours of discovery, stating categories of data, numbers affected, and remediation steps. 'Reasonable promptness' plus six weeks of undetected access is how you end up reading about it in the press first. Pair it with a duty to monitor, otherwise the clock measures your detection speed, not theirs.
2. Right to audit or assess - or acceptance of an attestation whose scope covers the actual service. A SOC 2 that excludes the storage layer is worthless, and without an audit right Halden could verify nothing during this incident.
3. Data lifecycle and deletion obligations aligned to Halden's classification and retention standard, with return-or-destroy certification at termination.

Second tier, if any leverage remains: subprocessor approval, minimum security requirements mapped to data class, and liability/indemnity with a defined cap.

Timing is part of the answer: negotiate now, while the incident is fresh and the vendor's leverage is low. Use recognised standard clauses rather than bespoke drafting so procurement can move quickly, and make sure the data-classification schedule is an annex that both sides can point to.