Comparing early May's incidents, the variable that most distinguishes the damage isn't the attack technique, it's how long customers took to find out.
At one end, a company that detected, engaged response and reported containment within nine days. At the other, cases where the news arrived through the attacker's own disclosure, before any statement.
The difference is rarely technical competence. It's contractual preparation and decisions taken beforehand: those who already knew whom to notify, within what deadline and with what wording kept control of the narrative and gave customers a chance to act.
For anyone contracting suppliers, that suggests where to focus in negotiation. A promise of perfect security is neither verifiable nor enforceable; notification deadlines, scope of what will be disclosed and communication channels are concrete clauses.
It's the difference between learning from your supplier that your data may have leaked and learning from the press, and that difference defines what can still be done.