The public breach ledger for June 2026 does not read like a story about direct intrusions of well-defended enterprises. It reads like a story about the vendors, subcontractors and hosted-application providers of those enterprises. Four disclosures published within a fortnight of each other tell the pattern more clearly than any consulting deck:
Read individually, each incident is a routine 2026 breach. Read together, they describe a market condition: the point of failure has moved down the supply chain. When you outsource a business process — customer support, licensing back-office, medical-device analytics, debt collection, contract manufacturing — you are extending your attack surface into the operating environment of another company. Your provider's security posture is, from a regulator's, a plaintiff's and a customer's point of view, your security posture. This article is written for the operations leader responsible for that decision — CIO, COO, head of shared services, general counsel — and offers a practical due-diligence framework to apply before signing, and to re-apply annually thereafter. We discuss the adjacent problem of *what your provider does with your data once it is inside* — the AI-plus-data-readiness dimension — in our companion piece on <a href="/en/blog/ai-customer-service-data-readiness-bottleneck-bpo-2026">AI in customer service and the data-readiness bottleneck</a>.
Three structural forces are compounding, and they are not going to reverse in 2027.
**First, the outsourced surface is larger than the internal surface.** A mid-market European company in 2026 typically runs 60 to 120 SaaS applications, contracts three to seven BPO providers, and depends on a further layer of sub-processors that those providers use. Each contract, integration and identity federation is a new potential path in. The TPWD incident is the archetype: the state agency did not need to be compromised for its citizens' passport numbers to leak; a licensing vendor two steps removed from the citizen was enough.
**Second, attackers have industrialised the vendor path.** Ransomware and data-extortion groups such as the one that claimed the Tata Electronics files, or the crews behind the RRCA collections incident, explicitly target managed-service providers, back-office processors and hosted-application vendors because the yield per compromise is higher — one break-in, dozens of downstream customers exposed. This is not a hypothesis; it is the observable modus operandi across the June 2026 disclosures.
**Third, regulators and courts are collapsing the legal distance between principal and processor.** Under the GDPR (Article 28), NIS2 in the European Union, and the sectoral variants (DORA for financial services, the AI Act for AI-touching processes), the data controller remains legally responsible for the processor's failures. The processor's contractual obligations must be flowed up to every sub-processor. A 2026 board that treats an outsourcing decision as a procurement decision, rather than a security-and-compliance decision, is misreading the liability map.
The following framework is what we run against our own operating model as a matter of internal discipline before we run it against any prospective client engagement. It is deliberately non-exhaustive; the point is to raise the questions that a mature partner should be able to answer in the room without deflection, and to make refusal to answer itself the signal.
Ask for the **live certificate scope statements**, not the marketing page. The floor for a serious 2026 BPO or outsourcing partner is **ISO/IEC 27001:2022** (information-security management system, with the current 93-control Annex A), a **SOC 2 Type II** report covering at least the Security and Confidentiality trust-service criteria, and, for cardholder data, a **PCI DSS Attestation of Compliance**. For health data, a **HIPAA** compliance attestation; for EU public-sector work, alignment with the **EUCS** scheme as it operationalises. Verify the scope: a certificate that only covers a training room in one city is not the certificate you need if delivery happens in three cities.
Where does your data physically live, and who else touches it? A defensible answer is a named data-centre region, a named cloud provider tier, and a **published, versioned sub-processor register** with 30-day change notice. If the provider treats its sub-processor list as confidential, that is a red flag under GDPR Article 28 and NIS2 due-diligence expectations. The TPWD-style path in — through an unnamed downstream vendor — is exactly what the sub-processor register is designed to expose before you sign, not after the breach notification.
Confirm how agents and engineers access your data. The 2026 baseline is: identity federated to your identity provider where possible, or SCIM-provisioned; **phishing-resistant multi-factor authentication** (FIDO2 / passkeys or equivalent) on every privileged account; role-based access aligned with a documented least-privilege matrix; **just-in-time elevation** with time-boxed sessions for administrative work; and **quarterly access reviews** with a written attestation. Ask to see a sample review and a sample JIT-elevation log with the sensitive fields redacted. A provider whose engineers hold standing production access is not a 2026-ready provider.
Encryption everywhere is table stakes; the question is *who holds the keys*. **TLS 1.3** in transit, **AES-256** at rest, keys managed in a hardware-security-module-backed KMS. For customers with strong data-sovereignty positions, ask whether the provider supports **customer-managed keys** (CMK) or a **Bring-Your-Own-Key** model, and how key-rotation cadence is documented. iRhythm-class incidents — data stored in third-party hosted applications — are meaningfully harder to monetise when the exfiltrated blob is encrypted with a key the attacker cannot reach.
Beyond the register itself, ask how the provider *audits* its own sub-processors. Is there a documented supplier-security programme? Are new sub-processors required to complete a security questionnaire and provide an ISO 27001 or SOC 2 report before onboarding? Is there a right-to-audit clause the provider actually exercises, or a pooled-audit membership? The RRCA and TPWD incidents both started upstream of the entity that was ultimately named in the breach notice. The audit-of-audits question is the one that catches those paths.
A contract clause committing to "prompt notification" is not a control. What you need in writing:
Ask when the provider last invoked this SLA and how the customer was informed. A provider who has never had an incident to notify has either been extraordinarily lucky, is too small to be a serious partner, or is not being candid.
Ask for the **penetration-testing cadence** (external and internal, minimum annual, ideally continuous via a bug-bounty programme or crowd-sourced platform), the **red-team exercise cadence** (an annual exercise is the modern floor), the **vulnerability-management SLA** (KEV-catalogued vulnerabilities patched within days, high-severity within one to two weeks, tracked in a KPI dashboard the customer can see), and the **tabletop exercise** cadence for incident response. Request a sanitised summary of the most recent penetration test findings and, more importantly, the **remediation timeline** for each finding. Findings without remediation are noise.
The last vector June 2026 exposed — through the Tata Electronics disclosure and the World Leaks publication — is that operational disruption and data exfiltration are increasingly coupled. Ask for the **RTO and RPO** targets by service tier, the geographic separation of primary and DR sites, the frequency of full failover tests (annual is the floor; semi-annual is defensible for critical processes), and the operational playbook for a ransomware event that requires the primary environment to be rebuilt from cold backups. A provider whose DR consists of a folder of runbooks and a hope has not tested any of it.
None of the above is Morocco-specific. It applies to any 2026 outsourcing decision, wherever the delivery centre sits. The Morocco argument, run through the framework, is that the country has structural properties that make the eight criteria *easier* to satisfy at mid-market economics than several alternative geographies:
Our own operating footprint at Call IT Dev — production teams in Casablanca, Rabat and Kenitra, with delivery cover from Madrid and Dubai, and adjacent services across [BPO](https://callitdev.com/en/services/bpo), [cybersecurity](https://callitdev.com/en/services/cybersecurity) and [technical support](https://callitdev.com/en/services/technical-support) — is designed to make the framework applicable rather than aspirational. The rationale for the country choice itself is set out in [why Morocco](https://callitdev.com/en/why-morocco).
If you take one deliverable from this article, make it the vendor questionnaire. A useful 2026 questionnaire is not a 400-item spreadsheet — those are gamed. A useful questionnaire is 30 to 40 sharp questions, each with a documentary artefact attached: certificate scope statement, sub-processor register, sample access-review, sanitised pen-test summary, incident-notification SLA clause, DR test attestation, KMS/key-custody architecture diagram, DPIA template. A provider who can return the artefact pack inside 48 hours has an operating model that already absorbs the framework. A provider who needs six weeks and then returns a marketing PDF is telling you something important about how the next incident will be handled.
The June 2026 disclosures — TPWD, iRhythm, RRCA, Tata Electronics — will not be the last of this pattern. The vendor perimeter is the perimeter, and the next wave of headlines is already being written inside a subcontractor of a subcontractor of a hosted-application provider you have never audited. The framework above is not exotic. It is the minimum viable due diligence for signing an outsourcing contract in the second half of 2026.
${CTA_VENDOR}
Because the highest-profile disclosures published in the fortnight around 18 June 2026 — Texas Parks and Wildlife Department (potentially 3M+ customers exposed via a third-party licensing vendor), iRhythm (data stored in business applications hosted by third parties, activity detected 8 June), RRCA Accounts Management (115,837 individuals), and Tata Electronics (200,000+ files published by the World Leaks group) — all originated upstream of the named entity, in the vendor or subcontractor layer, rather than through a direct intrusion of the enterprise itself.
Under GDPR Article 28, NIS2 and sectoral rules such as DORA, the data controller remains legally responsible for the processor's failures, and the processor's obligations must flow up to every sub-processor. The regulator, and any plaintiff class, sees the principal — not only the vendor that was actually compromised. Treating an outsourcing decision as a security-and-compliance decision, not a procurement decision, is the correct legal reading.
ISO/IEC 27001:2022 (with the 93-control Annex A of the current revision) plus a SOC 2 Type II report covering at least Security and Confidentiality. Add PCI DSS Attestation of Compliance for cardholder data, HIPAA attestation for health data, and alignment with EUCS for EU public-sector work. Verify the certificate scope statement — a scope that only covers one training room in one city is not the certificate the framework requires if delivery spans multiple sites.
A named 24/7/365 security incident response team, a written notification SLA that is faster than the GDPR 72-hour controller clock (24 hours from confirmed incident is a common floor for personal data, faster for regulated sectors), a defined secure-communication protocol with named executive contacts and update cadence, and contractual access to forensics artefacts sufficient for you to meet your own regulator's disclosure standard. Ask when the provider last invoked the SLA and how the customer was informed.
Ask for a published, versioned sub-processor register with 30-day change notice, a documented supplier-security programme, evidence that new sub-processors must pass a security questionnaire and provide an ISO 27001 or SOC 2 report before onboarding, and a right-to-audit clause the provider actually exercises (or membership in a pooled-audit programme). A provider that treats its sub-processor list as confidential is a red flag under GDPR Article 28 and NIS2 due-diligence expectations.
Because Morocco Law 09-08 is aligned with GDPR principles (defensible EU contractual footing), the CET time-zone overlap closes the "we will get to it in the morning" gap that a 12-hour offshore delta imposes on incident response, and the shift in Moroccan offshoring exports toward IT and cybersecurity work has thickened the local senior security bench (ISO 27001 lead auditors, CISSP-grade and OSCP-grade engineers) to a level where the eight-criterion framework can be staffed at nearshore economics rather than Zurich or Frankfurt day rates.
CALL IT DEV — Software, AI and dedicated tech teams — Casablanca | Madrid | Dubai — contact@callitdev.com — +212-537-373777