Third-party data breaches are becoming the new norm, but most companies aren’t taking important steps to protect themselves.

Ponemon Institute’s third annual “Data Risk in the Third-Party Ecosystem” study, released Monday, found that 59 percent of respondent companies experienced a data breach caused by a third party or vendor. Another 22 percent of respondents said they didn’t know if they had been impacted by a third-party data breach over the past year.