Should we contact the supplier first or check our own exposure first?

Check your own connections first. Knowing which of your assets touch the supplier, and whether the impact is direct, lets you ask the supplier specific questions instead of a generic one, and gives you something to report upward while you wait for their reply.