Companies are responsible for data breaches at their third-party contractors