Topic
Security discipline covering risks that vendors, suppliers and partners introduce, including breaches that spread through shared systems or outsourced services.
Unit 42 says compromised credentials were enough to enter a European bank through a third-party-managed gateway not set to enforce strict authentication. It judged the actor opportunistic, though the months of activity looked like espionage.
Reality
The FBI confirmed a contractor's failure to apply a critical Oracle PeopleSoft patch, CVE-2026-35273, led to a breach affecting thousands of employees. Any organisation that outsources PeopleSoft operations is exposed in the same way wherever its operator has not installed the fix.
Reality
EY spotted unusual activity on a support-ticket platform holding client tax files on 23 April, 11 days after the last reported unauthorised access. Goldman Sachs and Man Group say their own networks held. The weak point lay in the adviser's tools.
Reality
FBI said a contractor's failure to apply a security patch on a third-party platform let ShinyHunters steal personal details of thousands of bureau employees. The patch had already been issued, so the breach came down to one missed update on a platform the Bureau did not manage itself.
Perspective Coverage
11 publishersReality
The bank says its own systems are clean and points at a contractor of a contractor it will not name. That is precisely where most vendor-risk programs stop looking.
Reality
The records cover orders placed between November 2019 and August 2021, years past the 90-day deletion window Trezor advertises. Trezor says it held repeated written confirmation from ShipMonk that the data was gone.
Perspective Coverage
3 publishersReality
Between March and April 2025 intruders searched an industrial automation firm for "customers" and "SCADA", then bundled about 800 files. FBI and CISA now want least privilege applied to integrator access.
Reality
The bureau has not confirmed a breach and says it cannot yet tell whether its own systems or a third-party provider were the way in, while Reuters and 404 Media report that sample records match real personnel.
Perspective Coverage
3 publishersReality
The Army and Air Force Exchange Service says it is investigating suspicious emails and app push notifications sent to its customers, and it has not said yet whether its own systems or a partner's were involved.
Reality
The Transportation Department's final rule drops amenity obligations for ten causes of disruption. Cyberattacks qualify only while the carrier can show compliance with applicable cybersecurity regulations, language Crowell & Moring calls notably broad.
Reality
The findings a consulting firm produced for BMO Harris in 2015 now sit inside an FTC complaint as evidence against the processor they described, and the $12 million and the processing ban fall on the processor alone.
Reality
IDScan.net sells the compliance layer behind age and ID checks at thousands of dispensaries and at Hertz, and Techdirt notes its trust page stayed up for days after the dark web store opened. The FBI is now asking where the images came from.
Reality
SecurityWeek argues the security job is recruited on technical depth and reviewed at budget time on cost and growth, and that mismatch, not any breach, is what costs the seat.
Reality
Black Kite counted 13,336 disclosed incidents with known revenue from January 2023 to June 2026. Companies between $10M and $1B took 73%, and the share never left a three-point band.
Reality