• Contact the authorities
  Report the attack right away to your local police department. If they’re not familiar with investigating information compromises, contact your local FBI office.
• Confirm the vendor has a fix
  Make sure that the vendor fixes the vulnerabilities and ensures that your information will be safe going forward, if your business decides to continue using the vendor.
• Notify customers
  If your data or personal information was compromised, make sure you notify the affected parties ― they could be at risk of identity theft. Find information on how to do that at Data Breach Response: A Guide for Business. Find it at FTC.gov/DataBreach

https://www.ftc.gov/tips-advice/business-center/small-businesses/cybersecurity/vendor-security