Topic
Security risk category covering how contractors, vendors, and other outside parties can access and potentially misuse or expose sensitive systems and data.
ASOS shares fell 10% after attackers used one employee's stolen login to push an extortion message through its app, a dev.to account says. That single credential was enough to reach third-party messaging tools, so those consoles need production-grade access controls.
Reality
Denmark says hackers used a Danish company's search access to the Central Person Register to reach names, addresses and ID numbers of 8.8 million people. Because that access is a service offered to businesses by design, every partner account with search rights is part of the register's security perimeter.
Perspective Coverage
15 publishersReality
South Korea's financial regulator gave lenders until Thursday to check every internet-facing system after hackers breached at least seven banks. Attackers entered through tools built for loan recruiters and staff, so the repair falls on how much credit data banks let outsiders see.
Reality
The medical equipment network says social engineering against a third-party contractor's session opened its cloud patient management and document systems in early June, and the HHS portal now lists 4,115,802 people.
Reality
DGFiP says the intruder used a stolen employee identifier and an authorised third party's credentials, and claimed to bypass MFA. No zero-day was involved.
Reality
Its own Risk Report says an internal flag that disabled blocking also disabled logging, on a surface staffed by vendors that could not screen out CB-1 threat actors.
Reality