Published2023
MOVEit Transfer Breach
File Transfer Vendor Risk
A vendor that moves sensitive files is part of your security perimeter.
2,700+ organizations and 90M+ individuals reportedly affected.
Read case study100 Real-World TPRM Breach Lessons
Top 100 TPRM Breaches Intelligence Library
100 Breaches Every TPRM Professional Should Study
A practical intelligence library of third-party breaches, vendor failures, software supply-chain attacks, SaaS compromises, file-transfer incidents, MSP breaches, healthcare vendor exposures, payment processor failures, data broker breaches, open-source attacks, and fourth-party risk events.
Published Case Studies: 100 / 100
"Most breach write-ups explain what happened to the victim company. LearnTPRM studies what happened inside the trust layer, the vendor, supplier, SaaS platform, software update, file-transfer system, support provider, data processor, MSP, open-source dependency, or fourth party that quietly became the attack path. This library is built for people who want to understand third-party risk through real incidents, not theory."
Showing 100 of 100 breaches.
Published2020
SolarWinds Orion Supply Chain Attack
Software Supply Chain Attack
Trusted software updates can become trusted attack paths.
18,000+ customers received the trojanized update; 9 US federal agencies compromised.
Read case studyPublished2024
Change Healthcare Cyberattack
Critical Third-Party Dependency
Vendor concentration can become national operational risk.
US healthcare payments disrupted for weeks; estimated $2B+ in losses.
Read case studyPublished2024
Snowflake Customer Data Theft
SaaS and Credential-Based Risk
Cloud responsibility is shared, but exposure is still owned by the business.
165+ customer tenants targeted; hundreds of millions of records reportedly stolen.
Read case studyPublished2025
Salesloft Drift OAuth Token Breach
SaaS Integration and OAuth Risk
Connected apps and tokens are third-party access paths.
Hundreds of downstream SaaS tenants exposed via stolen integration tokens.
Read case studyPublished2021
Kaseya VSA Ransomware Supply Chain Attack
MSP and Remote Management Risk
A privileged vendor tool can become a ransomware distribution channel.
1,500+ downstream businesses encrypted via 60 compromised MSPs.
Read case studyPublished2020 to 2021
Accellion FTA Breach
Legacy File Transfer Risk
End-of-life technology inside the vendor layer can become a mass breach trigger.
Dozens of major enterprises and universities breached through one EOL appliance.
Read case studyPublished2017
NotPetya and M.E.Doc Supply Chain Attack
Destructive Software Supply Chain Attack
A small software dependency can create global business disruption.
$10B+ in global damages; Maersk, Merck, FedEx and others hit hard.
Read case studyPublished2019
AMCA, Quest and LabCorp Healthcare Vendor Breach
Healthcare Billing Vendor Breach
A billing vendor can quietly hold millions of sensitive records.
25M+ patient records exposed; AMCA filed for bankruptcy.
Read case studyPublished2026
Tata Electronics Supplier Breach
Supplier and Fourth-Party Exposure
Manufacturing suppliers can expose customer IP, designs, and ecosystem risk.
Sensitive customer designs and supplier ecosystem data reportedly leaked.
Read case studyPublished2005
CardSystems Solutions Breach
Payment Processor Breach
A processor that retains data it should not is a breach already waiting.
40M card records reportedly exposed; CardSystems lost its merchant licence.
Read case studyPublished2005
ChoicePoint Data Broker Breach
Data Broker Breach
Third-party data brokers turn weak onboarding into mass identity theft.
163,000 consumer records exposed; first wave of US breach notification laws.
Read case studyPublished2007
TJX Payment Ecosystem Breach
Retail Vendor / Payment Ecosystem
Weak wireless and weak processor controls are joint third-party failures.
94M card records reportedly exposed across TJX brands.
Read case studyPublished2008
Heartland Payment Systems Breach
Payment Processor Breach
When the processor is breached, every merchant downstream is exposed.
130M+ card numbers reportedly stolen; ~$140M in disclosed costs.
Read case studyPublished2008
RBS WorldPay Payroll Card Processor Breach
Payment Processor Breach
A processor breach can become real-world cash theft in hours.
$9M coordinated ATM cash-out across 280 cities in under 12 hours.
Read case studyPublished2011
Epsilon Email Marketing Vendor Breach
Marketing Vendor Breach
An email vendor is a phishing-grade access path into your customers.
50+ major brands forced to notify customers of email exposure.
Read case studyPublished2011
RSA SecurID Authentication Supplier Breach
Identity / Authentication Supplier
A breach at your authentication supplier becomes a breach of your trust model.
SecurID seed compromise used to pivot into Lockheed Martin and others.
Read case studyPublished2011
DigiNotar Certificate Authority Breach
Certificate Authority Breach
A certificate authority breach breaks trust for every downstream user.
500+ fraudulent certificates issued; DigiNotar bankrupt within months.
Read case studyPublished2011
Comodo Reseller Certificate Supply Chain Attack
Certificate Authority / Reseller Risk
Your CA's resellers are part of your trust chain.
9 fraudulent certificates issued for major web properties.
Read case studyPublished2012
Global Payments Processor Breach
Payment Processor Breach
PCI-DSS compliance is a floor, not a control.
1.5M card records reportedly exposed; ~$100M disclosed costs.
Read case studyPublished2013
Target HVAC Vendor Breach
Retail Vendor Breach
Any vendor with network access is a security vendor.
40M cards + 70M personal records exposed; CEO and CIO resigned.
Read case studyPublished2014
Goodwill POS Vendor Breach
POS Vendor Breach
Shared POS providers create shared blast radius.
~868,000 cards exposed across 330 Goodwill locations.
Read case studyPublished2014
Jimmy John's POS Vendor Breach
POS Vendor Breach
Franchise chains inherit vendor risk, whether or not they chose the vendor.
216 franchise stores breached via a single POS vendor's stolen credentials.
Read case studyPublished2014
Dairy Queen POS Backoff Malware Breach
POS / Payment Vendor Breach
Vendor remote-access tools are POS supply chain risk.
395 franchise locations infected with Backoff via vendor credentials.
Read case studyPublished2014
Home Depot Vendor Credential Breach
Retail Vendor Access
Vendor credentials must die at the network boundary.
56M cards + 53M emails exposed; ~$200M in disclosed costs.
Read case studyPublished2014
JPMorgan Corporate Challenge Third-Party Breach
Third-Party Website Breach
Forgotten third-party sites are forgotten attack paths.
76M households + 7M small businesses exposed via a vendor-run website.
Read case studyPublished2015
OPM Contractor Background Investigation Breach
Government Vendor / Contractor Risk
Contractor credentials are part of your attack surface.
21.5M federal background investigation records exposed.
Read case studyPublished2015
T-Mobile and Experian Credit Check Vendor Breach
Data Processor / Credit Vendor
Your credit check vendor becomes a custodian of your applicants.
15M T-Mobile applicants exposed via an Experian processor.
Read case studyPublished2015 to 2016
Wendy's POS Vendor Breach
POS Vendor Breach
Vendor remote access into franchises is shared risk.
1,025 Wendy's restaurants breached through a POS vendor.
Read case studyPublished2016
Oracle MICROS Hospitality POS Breach
Hospitality POS Vendor
A POS vendor's support portal is a high-value target.
700+ MICROS-affiliated systems and customer support portal compromised.
Read case studyPublished2017
Sabre SynXis Hotel Reservation Platform Breach
Hospitality SaaS / Reservation Vendor
Reservation platforms quietly process millions of card transactions.
36,000+ hotels notified after an attacker accessed reservation data.
Read case studyPublished2017
Equifax Open-Source Component Breach
Open Source / Software Dependency
Open-source dependencies are part of your TPRM scope.
147M consumer records exposed via an unpatched Apache Struts dependency.
Read case studyPublished2017
CCleaner Software Update Supply Chain Attack
Software Supply Chain Attack
Signed updates from a trusted utility can still ship malware.
2.27M users received a backdoored CCleaner build.
Read case studyPublished2018
event-stream npm Dependency Attack
Open Source Supply Chain
Package maintainer handoffs are supply chain risk events.
Targeted theft of crypto wallet credentials from downstream apps.
Read case studyPublished2018
Ticketmaster Inbenta Third-Party JavaScript Breach
Third-Party JavaScript / SaaS Vendor
Every third-party script on your checkout is a payment vendor.
40,000+ UK customers exposed; £1.25M ICO fine.
Read case studyPublished2018
British Airways Magecart Third-Party Script Attack
Third-Party JavaScript / Web Supply Chain
Website dependencies are payment supply chain risk.
380,000 transactions skimmed; £20M ICO fine.
Read case studyPublished2018
Delta Air Lines 24/7.ai Vendor Breach
Customer Support Vendor
Customer support chat scripts can capture payment data.
Hundreds of thousands of Delta customers exposed via a chat vendor.
Read case studyPublished2018
Sears 24/7.ai Customer Support Vendor Breach
Customer Support Vendor
Shared support vendors create shared breach events.
100,000+ Sears customers notified after a vendor compromise.
Read case studyPublished2018
Best Buy Third-Party Chat Vendor Breach
Customer Support Vendor
Live chat is a payment-adjacent surface.
Best Buy customers exposed via the same shared chat vendor.
Read case studyPublished2018
FedEx Bongo International Legacy Vendor Exposure
Legacy Vendor Exposure
Acquired vendors bring acquired exposure.
119,000+ scanned ID documents exposed in an unsecured S3 bucket.
Read case studyPublished2018
PageUp HR SaaS Vendor Breach
HR SaaS Vendor
HR SaaS holds the most sensitive employee data you own.
Dozens of universities and enterprises forced to notify applicants.
Read case studyPublished2018
Typeform Form Builder Vendor Breach
SaaS / Data Processor
Form vendors quietly become long-term data warehouses.
Hundreds of customer accounts affected across multiple industries.
Read case studyPublished2018 to 2019
Click2Gov Municipal Payment Software Breach
Government Payment Software
A vendor breach can replay across dozens of local governments.
50+ US municipalities breached through the same payment software.
Read case studyPublished2019
ASUS ShadowHammer Software Update Attack
Software Supply Chain Attack
A signed update from a hardware vendor is still a supply chain channel.
1M+ ASUS users received a signed but trojanized Live Update binary.
Read case studyPublished2019
Wipro IT Services Provider Breach
IT Services Provider Risk
An IT services provider with customer access is a fourth-party hub.
Multiple Wipro customers reportedly targeted via vendor accounts.
Read case studyPublished2019
Webmin Source Code Backdoor
Software Supply Chain Attack
Admin software in your perimeter is supply chain risk.
1M+ Webmin installs exposed to a remote-code-execution backdoor.
Read case studyPublished2019
Docker Hub Container Registry Breach
DevOps / Cloud Supply Chain
Build and registry credentials are supply chain credentials.
190,000 Docker Hub accounts exposed; build tokens at risk downstream.
Read case studyPublished2019
Verifications.io Email Validation Exposure
Data Broker / Marketing Vendor
Marketing vendors quietly accumulate billions of records.
763M records exposed in an unsecured MongoDB instance.
Read case studyPublished2019
DoorDash Third-Party Service Provider Breach
Third-Party Service Provider
A service provider breach can hit customers, merchants and drivers at once.
4.9M DoorDash users, merchants and Dashers exposed.
Read case studyPublished2019
Suprema BioStar 2 Biometric Exposure
Physical Security / Biometric Vendor
Biometric vendors hold data that cannot be rotated.
27.8M records, including fingerprints and facial templates, exposed.
Read case studyPublished2020
Blackbaud Cloud Fundraising Vendor Breach
Cloud SaaS / Nonprofit Vendor
A SaaS breach at one vendor can hit thousands of nonprofits at once.
Hundreds of universities, hospitals and nonprofits notified donors.
Read case studyPublished2020
Prestige Software Hotel Reservation Exposure
Hospitality Vendor Exposure
Reservation aggregators see every booking across every brand they serve.
10M+ booking records exposed across Booking.com, Expedia and others.
Read case studyPublished2020
Vertafore Insurance Software Vendor Exposure
Insurance Software Vendor
Insurance software vendors hold population-scale identity data.
27.7M Texas driver records exposed through vendor misconfiguration.
Read case studyPublished2020
Tyler Technologies Government Vendor Ransomware
Government Software Vendor
Government vendors are critical infrastructure under contract.
Major US government software provider disrupted by ransomware.
Read case studyPublished2020
Nitro PDF Document Productivity Vendor Breach
SaaS / Document Vendor
Document SaaS can hold years of customer files.
77M+ user records and stored documents reportedly exposed.
Read case studyPublished2020
Ledger and Shopify E-commerce Vendor Breach
E-commerce Vendor / Data Processor
An e-commerce vendor's customer list can become a phishing weapon.
270,000 Ledger customers exposed; ongoing phishing for years after.
Read case studyPublished2020
Shopify Rogue Insider Platform Breach
E-commerce Platform / Insider Risk
Insider risk at a platform vendor is platform-wide customer risk.
200+ merchant tenants exposed by rogue Shopify support agents.
Read case studyPublished2021
Codecov Bash Uploader Supply Chain Breach
CI/CD Supply Chain
CI/CD tools see every secret in every build.
Tens of thousands of CI environments forced to rotate credentials.
Read case studyPublished2021
PHP Git Server Source Code Backdoor Attempt
Open Source Supply Chain
Language-level source repos are tier-zero supply chain.
Two malicious PHP commits caught before reaching production.
Read case studyPublished2021
Dependency Confusion Supply Chain Attack
Open Source / Package Dependency
Your internal package names are public attack surface.
35+ major companies, including Apple and Microsoft, proven exploitable.
Read case studyPublished2021
ua-parser-js npm Supply Chain Attack
Open Source Supply Chain
An npm account takeover is a supply chain incident.
Malicious versions of a package with millions of weekly downloads.
Read case studyPublished2021
coa and rc npm Package Hijack
Open Source Supply Chain
Transitive dependencies need maintainer due diligence.
Two heavily-used npm packages briefly shipped credential stealers.
Read case studyPublished2021
SITA Airline Passenger Data Breach
Aviation Vendor Breach
Shared aviation vendors create shared passenger exposure.
Multiple Star Alliance and Oneworld carriers notified passengers.
Read case studyPublished2021
Volkswagen and Audi Marketing Vendor Exposure
Marketing Vendor Exposure
Marketing vendors hold long-tail prospect data.
3.3M Audi and Volkswagen prospects and customers exposed.
Read case studyPublished2021
CaptureRx Healthcare Administrative Vendor Breach
Healthcare Vendor Breach
Healthcare admin vendors are de facto data processors.
1.65M+ patients across multiple US health systems notified.
Read case studyPublished2021
Elekta Oncology Cloud Vendor Breach
Healthcare SaaS Vendor
Clinical SaaS outages are patient safety events.
170+ US healthcare providers disrupted; cancer treatments delayed.
Read case studyPublished2021
UKG Kronos Workforce Management Outage
HR / Workforce SaaS Vendor
Payroll vendors are operational resilience risks.
Weeks of payroll and timekeeping disruption for thousands of employers.
Read case studyPublished2021
Mimecast Certificate Compromise
Email Security / Certificate Risk
Vendor-issued certificates are part of your trust chain.
~10% of Mimecast customers using the affected certificate notified.
Read case studyPublished2021
Fujitsu ProjectWEB Government Platform Breach
Government Collaboration Vendor
Collaboration platforms become shadow government file shares.
Multiple Japanese government ministries notified of exposure.
Read case studyPublished2022
Okta and Sitel Support Vendor Breach
Identity / Support Vendor Risk
Identity provider support staff are part of your security perimeter.
366 Okta tenants impacted via a third-party support provider.
Read case studyPublished2022
Twilio SaaS Provider Phishing Breach
SaaS / Communications Vendor
Communications vendors hold MFA-grade trust.
163 Twilio customers, including downstream Signal users, affected.
Read case studyPublished2022
Signal Downstream of Twilio
Fourth-Party / Communications Vendor
Your messaging vendor's vendor is your fourth party.
~1,900 Signal accounts re-registered due to a Twilio compromise.
Read case studyPublished2022
Mailchimp Email Marketing Platform Breach
Email Marketing Vendor
Marketing platforms with crypto customers are high-value targets.
Multiple breaches in 2022 and 2023 targeting crypto and finance brands.
Read case studyPublished2022
OpenSea and Customer.io Email Vendor Breach
Email Vendor / SaaS Breach
Email vendors carry brand-grade phishing power.
OpenSea customer email list exposed via a vendor insider.
Read case studyPublished2022
HubSpot CRM Vendor Breach
CRM SaaS Vendor
CRM tenants are sales pipeline data lakes.
Multiple crypto and finance customers exposed through a HubSpot incident.
Read case studyPublished2022
Heroku OAuth GitHub Integration Breach
OAuth / Cloud Integration
OAuth tokens between platforms are inter-vendor blast radius.
Customer GitHub repos accessed via stolen Heroku and Travis tokens.
Read case studyPublished2022
Travis CI Secret Exposure
CI/CD Supply Chain
Build pipelines are third-party privileged access.
Thousands of repositories with leaked environment variables exposed.
Read case studyPublished2022
Toyota and Kojima Industries Supplier Attack
Critical Supplier Breach
Manufacturing supplier outages stop production lines.
Toyota halted Japan production at 14 plants for a full day.
Read case studyPublished2022 to 2023
Toyota T-Connect Cloud Misconfiguration
Cloud / SaaS Misconfiguration
Vendor-managed cloud is still your cloud.
2.15M Toyota T-Connect customer records exposed for nearly a decade.
Read case studyPublished2022
OneTouchPoint Healthcare Mailing Vendor Breach
Healthcare Vendor Breach
Mailing vendors handle PHI without acting like it.
30+ health plans notified 4.1M+ members of exposure.
Read case studyPublished2022
Eye Care Leaders EMR Vendor Breach
Healthcare SaaS Vendor
Specialty EMR vendors are concentration risks for their niche.
3.6M+ patients across 40+ eye care providers notified.
Read case studyPublished2022
Professional Finance Company Debt Collection Breach
Healthcare / Debt Collection Vendor
Debt collection vendors hold PHI for years longer than providers do.
650+ US healthcare providers notified of patient data exposure.
Read case studyPublished2022
Illuminate Education EdTech Vendor Breach
Education Vendor Breach
EdTech vendors hold minors' data without minors' consent.
Millions of K-12 student records exposed across multiple US districts.
Read case studyPublished2023
GoAnywhere MFT File Transfer Vendor Exploitation
File Transfer Vendor Risk
MFT vendors are recurring Cl0p targets.
130+ organizations confirmed exposed; precursor to the MOVEit campaign.
Read case studyPublished2023
3CX Cascading Software Supply Chain Attack
Software Supply Chain Attack
Supply chain attacks can be supply chain attacks of supply chain attacks.
600,000+ 3CX customers exposed via a downstream Trading Technologies build.
Read case studyPublished2023
CircleCI CI/CD Vendor Breach
CI/CD Supply Chain
CI/CD vendor breaches are universal credential rotation events.
Every CircleCI customer instructed to rotate all secrets used in builds.
Read case studyPublished2023
MSI Firmware Signing Key Leak
Hardware / Firmware Supply Chain
Hardware vendor signing keys can outlive the hardware.
Intel Boot Guard and MSI signing keys reportedly leaked publicly.
Read case studyPublished2023
Barracuda ESG Email Security Appliance Breach
Security Appliance Vendor
Security appliances can become persistent backdoors.
Customers instructed to physically replace affected ESG appliances.
Read case studyPublished2023
JumpCloud Directory-as-a-Service Vendor Breach
Identity / Cloud Directory Vendor
Directory vendors are identity perimeter vendors.
Small set of crypto-sector customers targeted via JumpCloud commands.
Read case studyPublished2023
Okta Support System HAR File Breach
Identity / Support System Vendor
Support tickets carry session-grade secrets.
All Okta customer support users notified after HAR file theft.
Read case studyPublished2023
Zellis Payroll MOVEit-Linked Breach
Payroll Vendor / File Transfer
Payroll vendors are file-transfer customers, and that is your problem too.
BBC, BA, Boots and other UK employers notified via the Zellis chain.
Read case studyPublished2023
PBI Research Services MOVEit Data Exposure
Data Processor / File Transfer
Pension data processors are MFT-dependent.
Multiple US pension funds notified beneficiaries via PBI.
Read case studyPublished2023
ESO Solutions Emergency Medical Software Breach
Healthcare SaaS Vendor
EMS software vendors hold prehospital PHI.
2.7M patient records across multiple EMS agencies exposed.
Read case studyPublished2023
Infosys McCamish BPO Vendor Breach
Financial Services BPO Vendor
Financial BPO vendors hold customer data for their customers' customers.
6M+ Bank of America and other customers notified.
Read case studyPublished2023
AT&T Marketing Vendor Cloud Breach
Marketing Vendor / Cloud Breach
Telco marketing vendors hold call detail records.
73M+ AT&T customer records linked to a marketing vendor exposure.
Read case studyPublished2024
MediSecure E-Prescription Vendor Breach
Healthcare Vendor Breach
National e-prescription vendors are critical health infrastructure.
12.9M Australians had personal and health data exposed.
Read case studyPublished2024
CDK Global Auto Dealer Software Outage
Critical SaaS Vendor
Industry-specific SaaS monopolies are industry-wide concentration risk.
15,000+ North American auto dealerships disrupted for weeks.
Read case studyPublished2024
XZ Utils Open-Source Supply Chain Attack
Open Source Supply Chain
Open-source maintainer trust is a multi-year attack surface.
Near-miss backdoor in a near-universal Linux compression library.
Read case studyPublished2024
Polyfill.io Third-Party JavaScript Attack
Third-Party JavaScript Supply Chain
Free third-party scripts are free until they're not.
100,000+ websites served malicious JavaScript via a hijacked CDN domain.
Read case studyPublished2024
Ivanti Connect Secure VPN Exploitation
Security Appliance Vendor
Edge security appliances are edge security risks.
Thousands of Ivanti Connect Secure appliances mass-exploited.
Read case studyTPRM Blog
Latest breach alerts and TPRM analysis from the blog
Every new third-party breach, regulatory shift, and vendor risk lesson is written up on blog.learntprm.com within hours. Use these articles alongside the full case-study library below.
Founding SponsorAutonomous TPRM. 90% less manual effort.
Almost every case here was findable before it happened
Read enough third-party breaches and the pattern is brutal: an undisclosed fourth party, an expired certification, an exposure that sat on the internet for weeks. Nobody was lazy - the signals simply arrive faster than a human review cycle. The SAFE TPRM AI Co-Worker watches for them continuously.
This is for you if you own a third-party risk program - roughly 100+ vendors, quarterly reassessments, DORA / NIS2 / OCC pressure and no new headcount coming. The link opens Safe Security's platform page, not a gated form.
Five correlated data dimensions per vendor, refreshed continuously across the whole portfolio.
Zero-touch due diligenceContinuous monitoring across 5 dimensionsAI-powered risk scoring workflows
- The Fourth-Party Discovery agent finds the undisclosed downstream provider before it becomes your incident.
- The Outside-In agent detects new vulnerabilities, misconfigurations and breaches as they surface.
- The Threat Intel agent tracks leaked credentials, filings and legal events per vendor.
Evaluate SAFE for my organization
For security and risk leaders assessing a TPRM platform. Opens safe.security in a new tab.
25+
AI agents
90%
Less manual effort
None
Additional headcount
200+
Organizations globally
End to end
Intake to offboarding