Breach Year
2018
Breach Type
Legacy Vendor Exposure
TPRM Lesson
Acquired vendors bring acquired exposure.
What was the FedEx Bongo International Legacy Vendor Exposure breach?
The FedEx Bongo International exposure was a 2018 incident in which 119,000+ scanned identity documents from customers of Bongo International, a company FedEx acquired in 2014 and later rebranded, were found publicly accessible in an unsecured Amazon S3 bucket.
FedEx Bongo is the case that showed acquired vendors bring acquired exposure.
Bongo International was a package forwarding service that scanned customer passports, driving licences and other identity documents to comply with export rules.
FedEx acquired Bongo in 2014 and later folded it into FedEx Cross-Border, which was shut down in 2017. The scanned documents remained in an unsecured S3 bucket until researchers found them in early 2018.
A legacy storage bucket from an acquired subsidiary that outlived the business it served.
2009 to 2014. Bongo International collected scanned ID documents for compliance.
2014. FedEx acquired Bongo.
2017. The rebranded FedEx Cross-Border service was closed.
Feb 2018. Researchers at Kromtech Security found the open S3 bucket with 119,000+ scanned documents.
The case accelerated adoption of acquisition-triggered cloud inventory and mandatory deletion of collected identity documents once the business purpose ends.
No attack occurred. The vendor was simply forgotten. Legacy exposure is a TPRM problem even when nobody breaches anything.
A. Identity and Access. MFA and least privilege on all inherited cloud accounts.
B. SaaS and API Integrations. Inventory every cloud service from an acquired entity.
C. Software Supply Chain. Deprecate inherited tools with a plan, not by neglect.
D. File Transfer and Data Exchange. Enforce bucket-level public-access blocks by policy.
E. Data Protection. Encrypt at rest and enforce retention deletion.
F. Vendor Incident Response. Include acquired brands in IR runbooks.
G. Fourth-Party Risk. Discover cloud sub-vendors during due diligence.
H. Board and Executive Reporting. Report acquired-brand data footprint quarterly.
"When you buy a business you inherit its buckets. Inventory them or own them anyway."
A 2018 discovery of 119,000+ scanned ID documents in an open S3 bucket from a FedEx-acquired subsidiary.
The exposure stemmed from a subsidiary's inherited cloud footprint that FedEx did not inventory.
The S3 bucket was left publicly accessible after the acquired business was closed.
Passports, driving licences and other identity documents.
Reputational damage and industry rethink of post-acquisition data hygiene.
M&A cloud inventory, retention deletion and continuous public-access monitoring.
Acquired vendors bring inherited exposure that must be governed from day one.
Forgotten vendors are still your vendors.
All claims in this case study are grounded in verified public reporting.
TPRM Blog
Continue learning with the latest breach alerts, regulatory updates, and analyst playbooks from blog.learntprm.com.
Founding SponsorAlmost every case here was findable before it happened
Read enough third-party breaches and the pattern is brutal: an undisclosed fourth party, an expired certification, an exposure that sat on the internet for weeks. Nobody was lazy - the signals simply arrive faster than a human review cycle. The SAFE TPRM AI Co-Worker watches for them continuously.
This is for you if you own a third-party risk program - roughly 100+ vendors, quarterly reassessments, DORA / NIS2 / OCC pressure and no new headcount coming. The link opens Safe Security's platform page, not a gated form.
Five correlated data dimensions per vendor, refreshed continuously across the whole portfolio.
For security and risk leaders assessing a TPRM platform. Opens safe.security in a new tab.
25+
AI agents
90%
Less manual effort
None
Additional headcount
200+
Organizations globally
End to end
Intake to offboarding
Most people talk about risk management. Few can prove their expertise under pressure.
Start Your Free Certification