When a vendor's breach becomes yours: lessons from the Klue incident