Roughly a third of breaches now start somewhere you don't control: a vendor, a contractor, a support tool you gave access to once and forgot about.
The vendor gets breached, not you - and your data goes out through their door instead of yours. You did nothing wrong and you're still in the disclosure email.