vendor breach