Maybe so. In this case the breach occurred at a third party software vendor. You’d need to write a similar guarantee into any contracts you signed with vendors.