The Breaches That Changed Third-Party Risk Forever

TPRM Lesson

A vendor that moves sensitive files is part of your security perimeter.

Estimated Impact

2,700+ organizations and 90M+ individuals reportedly affected.

TPRM Lesson

Trusted software updates can become trusted attack paths.

Estimated Impact

18,000+ customers received the trojanized update; 9 US federal agencies compromised.

TPRM Lesson

Vendor concentration can become national operational risk.

Estimated Impact

US healthcare payments disrupted for weeks; estimated $2B+ in losses.

TPRM Lesson

Cloud responsibility is shared, but exposure is still owned by the business.

Estimated Impact

165+ customer tenants targeted; hundreds of millions of records reportedly stolen.

TPRM Lesson

Connected apps and tokens are third-party access paths.

Estimated Impact

Hundreds of downstream SaaS tenants exposed via stolen integration tokens.

TPRM Lesson

A privileged vendor tool can become a ransomware distribution channel.

Estimated Impact

1,500+ downstream businesses encrypted via 60 compromised MSPs.

TPRM Lesson

End-of-life technology inside the vendor layer can become a mass breach trigger.

Estimated Impact

Dozens of major enterprises and universities breached through one EOL appliance.

TPRM Lesson

A small software dependency can create global business disruption.

Estimated Impact

$10B+ in global damages; Maersk, Merck, FedEx and others hit hard.

TPRM Lesson

A billing vendor can quietly hold millions of sensitive records.

Estimated Impact

25M+ patient records exposed; AMCA filed for bankruptcy.

TPRM Lesson

Manufacturing suppliers can expose customer IP, designs, and ecosystem risk.

Estimated Impact

Sensitive customer designs and supplier ecosystem data reportedly leaked.

TPRM Lesson

A processor that retains data it should not is a breach already waiting.

Estimated Impact

40M card records reportedly exposed; CardSystems lost its merchant licence.

TPRM Lesson

Third-party data brokers turn weak onboarding into mass identity theft.

Estimated Impact

163,000 consumer records exposed; first wave of US breach notification laws.

TPRM Lesson

Weak wireless and weak processor controls are joint third-party failures.

Estimated Impact

94M card records reportedly exposed across TJX brands.

TPRM Lesson

When the processor is breached, every merchant downstream is exposed.

Estimated Impact

130M+ card numbers reportedly stolen; ~$140M in disclosed costs.

TPRM Lesson

A processor breach can become real-world cash theft in hours.

Estimated Impact

$9M coordinated ATM cash-out across 280 cities in under 12 hours.

TPRM Lesson

An email vendor is a phishing-grade access path into your customers.

Estimated Impact

50+ major brands forced to notify customers of email exposure.

TPRM Lesson

A breach at your authentication supplier becomes a breach of your trust model.

Estimated Impact

SecurID seed compromise used to pivot into Lockheed Martin and others.

TPRM Lesson

A certificate authority breach breaks trust for every downstream user.

Estimated Impact

500+ fraudulent certificates issued; DigiNotar bankrupt within months.

TPRM Lesson

Your CA's resellers are part of your trust chain.

Estimated Impact

9 fraudulent certificates issued for major web properties.

TPRM Lesson

PCI-DSS compliance is a floor, not a control.

Estimated Impact

1.5M card records reportedly exposed; ~$100M disclosed costs.

TPRM Lesson

Any vendor with network access is a security vendor.

Estimated Impact

40M cards + 70M personal records exposed; CEO and CIO resigned.

TPRM Lesson

Shared POS providers create shared blast radius.

Estimated Impact

~868,000 cards exposed across 330 Goodwill locations.

TPRM Lesson

Franchise chains inherit vendor risk, whether or not they chose the vendor.

Estimated Impact

216 franchise stores breached via a single POS vendor's stolen credentials.

TPRM Lesson

Vendor remote-access tools are POS supply chain risk.

Estimated Impact

395 franchise locations infected with Backoff via vendor credentials.

TPRM Lesson

Vendor credentials must die at the network boundary.

Estimated Impact

56M cards + 53M emails exposed; ~$200M in disclosed costs.

TPRM Lesson

Forgotten third-party sites are forgotten attack paths.

Estimated Impact

76M households + 7M small businesses exposed via a vendor-run website.

TPRM Lesson

Contractor credentials are part of your attack surface.

Estimated Impact

21.5M federal background investigation records exposed.

TPRM Lesson

Your credit check vendor becomes a custodian of your applicants.

Estimated Impact

15M T-Mobile applicants exposed via an Experian processor.

TPRM Lesson

Vendor remote access into franchises is shared risk.

Estimated Impact

1,025 Wendy's restaurants breached through a POS vendor.

TPRM Lesson

A POS vendor's support portal is a high-value target.

Estimated Impact

700+ MICROS-affiliated systems and customer support portal compromised.

TPRM Lesson

Reservation platforms quietly process millions of card transactions.

Estimated Impact

36,000+ hotels notified after an attacker accessed reservation data.

TPRM Lesson

Open-source dependencies are part of your TPRM scope.

Estimated Impact

147M consumer records exposed via an unpatched Apache Struts dependency.

TPRM Lesson

Signed updates from a trusted utility can still ship malware.

Estimated Impact

2.27M users received a backdoored CCleaner build.

TPRM Lesson

Package maintainer handoffs are supply chain risk events.

Estimated Impact

Targeted theft of crypto wallet credentials from downstream apps.

TPRM Lesson

Every third-party script on your checkout is a payment vendor.

Estimated Impact

40,000+ UK customers exposed; £1.25M ICO fine.

TPRM Lesson

Website dependencies are payment supply chain risk.

Estimated Impact

380,000 transactions skimmed; £20M ICO fine.

TPRM Lesson

Customer support chat scripts can capture payment data.

Estimated Impact

Hundreds of thousands of Delta customers exposed via a chat vendor.

TPRM Lesson

Shared support vendors create shared breach events.

Estimated Impact

100,000+ Sears customers notified after a vendor compromise.

TPRM Lesson

Live chat is a payment-adjacent surface.

Estimated Impact

Best Buy customers exposed via the same shared chat vendor.

TPRM Lesson

Acquired vendors bring acquired exposure.

Estimated Impact

119,000+ scanned ID documents exposed in an unsecured S3 bucket.

TPRM Lesson

HR SaaS holds the most sensitive employee data you own.

Estimated Impact

Dozens of universities and enterprises forced to notify applicants.

TPRM Lesson

Form vendors quietly become long-term data warehouses.

Estimated Impact

Hundreds of customer accounts affected across multiple industries.

TPRM Lesson

A vendor breach can replay across dozens of local governments.

Estimated Impact

50+ US municipalities breached through the same payment software.

TPRM Lesson

A signed update from a hardware vendor is still a supply chain channel.

Estimated Impact

1M+ ASUS users received a signed but trojanized Live Update binary.

TPRM Lesson

An IT services provider with customer access is a fourth-party hub.

Estimated Impact

Multiple Wipro customers reportedly targeted via vendor accounts.

TPRM Lesson

Admin software in your perimeter is supply chain risk.

Estimated Impact

1M+ Webmin installs exposed to a remote-code-execution backdoor.

TPRM Lesson

Build and registry credentials are supply chain credentials.

Estimated Impact

190,000 Docker Hub accounts exposed; build tokens at risk downstream.

TPRM Lesson

Marketing vendors quietly accumulate billions of records.

Estimated Impact

763M records exposed in an unsecured MongoDB instance.

TPRM Lesson

A service provider breach can hit customers, merchants and drivers at once.

Estimated Impact

4.9M DoorDash users, merchants and Dashers exposed.

TPRM Lesson

Biometric vendors hold data that cannot be rotated.

Estimated Impact

27.8M records, including fingerprints and facial templates, exposed.

TPRM Lesson

A SaaS breach at one vendor can hit thousands of nonprofits at once.

Estimated Impact

Hundreds of universities, hospitals and nonprofits notified donors.

TPRM Lesson

Reservation aggregators see every booking across every brand they serve.

Estimated Impact

10M+ booking records exposed across Booking.com, Expedia and others.

TPRM Lesson

Insurance software vendors hold population-scale identity data.

Estimated Impact

27.7M Texas driver records exposed through vendor misconfiguration.

TPRM Lesson

Government vendors are critical infrastructure under contract.

Estimated Impact

Major US government software provider disrupted by ransomware.

TPRM Lesson

Document SaaS can hold years of customer files.

Estimated Impact

77M+ user records and stored documents reportedly exposed.

TPRM Lesson

An e-commerce vendor's customer list can become a phishing weapon.

Estimated Impact

270,000 Ledger customers exposed; ongoing phishing for years after.

TPRM Lesson

Insider risk at a platform vendor is platform-wide customer risk.

Estimated Impact

200+ merchant tenants exposed by rogue Shopify support agents.

TPRM Lesson

CI/CD tools see every secret in every build.

Estimated Impact

Tens of thousands of CI environments forced to rotate credentials.

TPRM Lesson

Language-level source repos are tier-zero supply chain.

Estimated Impact

Two malicious PHP commits caught before reaching production.

TPRM Lesson

Your internal package names are public attack surface.

Estimated Impact

35+ major companies, including Apple and Microsoft, proven exploitable.

TPRM Lesson

An npm account takeover is a supply chain incident.

Estimated Impact

Malicious versions of a package with millions of weekly downloads.

TPRM Lesson

Transitive dependencies need maintainer due diligence.

Estimated Impact

Two heavily-used npm packages briefly shipped credential stealers.

TPRM Lesson

Shared aviation vendors create shared passenger exposure.

Estimated Impact

Multiple Star Alliance and Oneworld carriers notified passengers.

TPRM Lesson

Marketing vendors hold long-tail prospect data.

Estimated Impact

3.3M Audi and Volkswagen prospects and customers exposed.

TPRM Lesson

Healthcare admin vendors are de facto data processors.

Estimated Impact

1.65M+ patients across multiple US health systems notified.

TPRM Lesson

Clinical SaaS outages are patient safety events.

Estimated Impact

170+ US healthcare providers disrupted; cancer treatments delayed.

TPRM Lesson

Payroll vendors are operational resilience risks.

Estimated Impact

Weeks of payroll and timekeeping disruption for thousands of employers.

TPRM Lesson

Vendor-issued certificates are part of your trust chain.

Estimated Impact

~10% of Mimecast customers using the affected certificate notified.

TPRM Lesson

Collaboration platforms become shadow government file shares.

Estimated Impact

Multiple Japanese government ministries notified of exposure.

TPRM Lesson

Identity provider support staff are part of your security perimeter.

Estimated Impact

366 Okta tenants impacted via a third-party support provider.

TPRM Lesson

Communications vendors hold MFA-grade trust.

Estimated Impact

163 Twilio customers, including downstream Signal users, affected.

TPRM Lesson

Your messaging vendor's vendor is your fourth party.

Estimated Impact

~1,900 Signal accounts re-registered due to a Twilio compromise.

TPRM Lesson

Marketing platforms with crypto customers are high-value targets.

Estimated Impact

Multiple breaches in 2022 and 2023 targeting crypto and finance brands.

TPRM Lesson

Email vendors carry brand-grade phishing power.

Estimated Impact

OpenSea customer email list exposed via a vendor insider.

TPRM Lesson

CRM tenants are sales pipeline data lakes.

Estimated Impact

Multiple crypto and finance customers exposed through a HubSpot incident.

TPRM Lesson

OAuth tokens between platforms are inter-vendor blast radius.

Estimated Impact

Customer GitHub repos accessed via stolen Heroku and Travis tokens.

TPRM Lesson

Build pipelines are third-party privileged access.

Estimated Impact

Thousands of repositories with leaked environment variables exposed.

TPRM Lesson

Manufacturing supplier outages stop production lines.

Estimated Impact

Toyota halted Japan production at 14 plants for a full day.

TPRM Lesson

Vendor-managed cloud is still your cloud.

Estimated Impact

2.15M Toyota T-Connect customer records exposed for nearly a decade.

TPRM Lesson

Mailing vendors handle PHI without acting like it.

Estimated Impact

30+ health plans notified 4.1M+ members of exposure.

TPRM Lesson

Specialty EMR vendors are concentration risks for their niche.

Estimated Impact

3.6M+ patients across 40+ eye care providers notified.

TPRM Lesson

Debt collection vendors hold PHI for years longer than providers do.

Estimated Impact

650+ US healthcare providers notified of patient data exposure.

TPRM Lesson

EdTech vendors hold minors' data without minors' consent.

Estimated Impact

Millions of K-12 student records exposed across multiple US districts.

TPRM Lesson

MFT vendors are recurring Cl0p targets.

Estimated Impact

130+ organizations confirmed exposed; precursor to the MOVEit campaign.

TPRM Lesson

Supply chain attacks can be supply chain attacks of supply chain attacks.

Estimated Impact

600,000+ 3CX customers exposed via a downstream Trading Technologies build.

TPRM Lesson

CI/CD vendor breaches are universal credential rotation events.

Estimated Impact

Every CircleCI customer instructed to rotate all secrets used in builds.

TPRM Lesson

Hardware vendor signing keys can outlive the hardware.

Estimated Impact

Intel Boot Guard and MSI signing keys reportedly leaked publicly.

TPRM Lesson

Security appliances can become persistent backdoors.

Estimated Impact

Customers instructed to physically replace affected ESG appliances.

TPRM Lesson

Directory vendors are identity perimeter vendors.

Estimated Impact

Small set of crypto-sector customers targeted via JumpCloud commands.

TPRM Lesson

Support tickets carry session-grade secrets.

Estimated Impact

All Okta customer support users notified after HAR file theft.

TPRM Lesson

Payroll vendors are file-transfer customers, and that is your problem too.

Estimated Impact

BBC, BA, Boots and other UK employers notified via the Zellis chain.

TPRM Lesson

Pension data processors are MFT-dependent.

Estimated Impact

Multiple US pension funds notified beneficiaries via PBI.

TPRM Lesson

EMS software vendors hold prehospital PHI.

Estimated Impact

2.7M patient records across multiple EMS agencies exposed.

TPRM Lesson

Financial BPO vendors hold customer data for their customers' customers.

Estimated Impact

6M+ Bank of America and other customers notified.

TPRM Lesson

Telco marketing vendors hold call detail records.

Estimated Impact

73M+ AT&T customer records linked to a marketing vendor exposure.

TPRM Lesson

National e-prescription vendors are critical health infrastructure.

Estimated Impact

12.9M Australians had personal and health data exposed.

TPRM Lesson

Industry-specific SaaS monopolies are industry-wide concentration risk.

Estimated Impact

15,000+ North American auto dealerships disrupted for weeks.

TPRM Lesson

Open-source maintainer trust is a multi-year attack surface.

Estimated Impact

Near-miss backdoor in a near-universal Linux compression library.

TPRM Lesson

Free third-party scripts are free until they're not.

Estimated Impact

100,000+ websites served malicious JavaScript via a hijacked CDN domain.

TPRM Lesson

Edge security appliances are edge security risks.

Estimated Impact

Thousands of Ivanti Connect Secure appliances mass-exploited.