tag: Third-Party-Risk · 28 items
- Engineer — Plan: If Bunny CDN serves your assets or sits in your delivery pipeline, review the incident report at their status page and rotate any API keys or access tokens tied to your account as a precaution until scope is confirmed.
- SOC/IR — Skip
- Leader — Plan: Confirm whether your organization uses Bunny CDN and, if so, request a customer-facing incident report from them; assess whether any customer data or content delivery was affected and whether disclosure obligations apply.
- Engineer — Skip
- SOC/IR — Learn: No IOCs or TTPs published; breach affects a Japanese ISP subsidiary with no enterprise detection surface. Monitor for follow-on phishing campaigns targeting affected customers if relevant to your sector.
- Leader — Plan: Benchmark your own vendor breach-notification SLAs against this incident — Sony’s response timeline and disclosure process offer a reference case for updating your third-party incident response playbook this quarter.
- Engineer — Learn: No exploitable software or patch involved; the breach vector was a third-party marketing platform, reinforcing the risk of partner-held data access — no direct action on running systems.
- SOC/IR — Skip
- Leader — Plan: Review which marketing or data platforms used by business partners hold customer PII; ENGIE’s breach illustrates how indirect third-party access creates direct exposure — add to vendor risk audit backlog this quarter.
- Engineer — Skip
- SOC/IR — Learn: Healthcare sector breach via Quanum LSM system access; no published IOCs or TTPs available yet, so file for context on healthcare-targeting threat actors.
- Leader — Act: If your organization uses Quest Diagnostics or shares patient data with them, confirm your exposure scope and request their incident report; this is a named healthcare breach likely to trigger customer and regulatory questions under HIPAA.
- Engineer — Skip
- SOC/IR — Learn: Three breaches in a month at a single organization suggests systemic compromise rather than isolated incidents; useful pattern for recognizing persistent-access scenarios in triage.
- Leader — Plan: Nikkei is a major media/financial data vendor — confirm whether your organization holds a subscription or data-sharing relationship and review your vendor risk posture; the repeated breach pattern may warrant a formal attestation request.
- Engineer — Skip
- SOC/IR — Skip
- Leader — Plan: Bullhorn is widely used for staffing and recruiting workflows; if it appears in your vendor inventory, confirm operational impact and establish a watch for any breach disclosure or data exposure announcement.
- Engineer — Skip
- SOC/IR — Learn: A contractor breach cascading into federal court operations is a useful reference for understanding third-party blast radius, but no IOCs or TTPs are available to drive detection or hunting work.
- Leader — Learn: This incident illustrates how a government contractor compromise can disrupt downstream government services — useful context for third-party risk discussions and board briefings, but BAE Systems is not a widely-used commercial vendor so direct exposure is unlikely for most enterprises.
- Engineer — Learn: Unit 42’s attack dissection may surface detection patterns and architectural weaknesses relevant to third-party integrations, but no specific CVEs, PoCs, or patch actions are indicated — worth reading to inform future design decisions around supplier access.
- SOC/IR — Learn: The full write-up likely contains TTPs and detection strategies from a real intrusion, but the summary provides no IOCs, ATT&CK mappings, or specific tooling details to act on immediately — review for hunting hypotheses if the sector is relevant.
- Leader — Learn: A case study showing how a low-sophistication attack leveraged third-party exposure at a bank is directly applicable to vendor risk discussions and board-level risk register reviews — useful framing for upcoming supplier security reviews.
- Engineer — Learn: No specific CVE or software named to patch, but this is a clear reminder that contractor-owned patch obligations need enforcement mechanisms — audit your third-party patch SLAs and verify completion rather than trusting self-attestation.
- SOC/IR — Learn: ShinyHunters remains active against enterprise targets; no IOCs or TTPs are surfaced in this item, so no immediate detection work, but worth noting actor persistence when triaging future alerts.
- Leader — Learn: A high-profile case where contractor patch accountability failed upward — useful material for board discussions on third-party risk governance and whether your vendor contracts include enforceable patch-completion verification.
- Engineer — Skip
- SOC/IR — Learn: Breach involved exploitation of a third-party software vulnerability; no IOCs, TTPs, or detection signals published, so no immediate hunt or detection action is possible.
- Leader — Act: If your organization uses Frontline Education for HR or workforce management, confirm your exposure and request an incident report and attestation from the vendor this week.
- Engineer — Learn: The attack path — compromising a security product to harvest high-privilege credentials — is a reminder that security tooling itself carries a large blast radius when over-credentialed; audit what access your security vendors hold in production and whether least-privilege applies to them.
- SOC/IR — Learn: The technique of pivoting from a compromised third-party security agent to internal high-privilege credentials is worth adding to hunting mental models, but no IOCs or specific TTPs are published yet to act on.
- Leader — Plan: A major breach driven by a third-party security vendor’s own vulnerability is a vendor risk trigger: this quarter, review what credentials and access levels your security tooling holds and confirm your vendor contracts include breach-notification obligations.
- Engineer — Skip
- SOC/IR — Skip
- Leader — Learn: 23.6 million records stolen via an unspecified server flaw is a useful vendor-risk case study; assess whether Gyazo or similar image-sharing tools are used in your environment and whether they appear in your vendor inventory.
- Engineer — Learn: Gyazo is a common developer screenshot tool, not infrastructure you run; if your team uses it, check for corporate accounts and enforce credential rotation since password hashes were exposed.
- SOC/IR — Learn: No IOCs or TTPs published with this breach notification; monitor for credential-stuffing attempts against corporate SSO if employees use Gyazo with shared passwords, but no immediate hunt action is supported by the available detail.
- Leader — Learn: Gyazo is a widely-used developer tool and this breach scale warrants checking whether your org has corporate accounts or significant employee exposure, though no board-level action is indicated without evidence of enterprise-wide use.
- Engineer — Skip
- SOC/IR — Skip
- Leader — Learn: A consumer-facing breach, but the mechanism — a logistics/shipping sub-processor leaking customer PII — is a useful illustration of fourth-party risk that applies when auditing your own vendor inventory for non-obvious data handlers.
- Engineer — Learn: Breach was via unauthorized access to third-party applications, not a patchable CVE; reinforces the need to audit and restrict third-party SaaS access, but no concrete engineering action is available from this disclosure alone.
- SOC/IR — Learn: ShinyHunters attribution is a useful actor profile update, but no IOCs, TTPs, or detection-relevant technical detail are published yet; monitor for follow-on disclosures that include actionable indicators.
- Leader — Act: McKesson is a major healthcare and pharma supply chain vendor — if your organization has a relationship with them, confirm exposure scope this week and request their incident attestation; 284 million claimed patient records puts this in HIPAA notification and board-visibility territory.
- Engineer — Skip
- SOC/IR — Learn: No IOCs or TTPs published; monitor for follow-on phishing lures targeting Hasbro employees that could appear in broader campaigns.
- Leader — Plan: Review whether your organization has vendor or partner relationships with Hasbro that involve shared employee or financial data; add to third-party breach tracker and revisit data-sharing agreements.
- Engineer — Skip
- SOC/IR — Skip
- Leader — Learn: A UK airport operator breach involving Wi-Fi registration data is a useful prompt to review what data third-party venue services collect on behalf of employees, but no immediate action is warranted for most non-UK enterprises given the regional scope and absence of published IOCs or attack detail.
- Engineer — Skip
- SOC/IR — Skip
- Leader — Learn: A third-party software flaw exposed HR-category data (employee and applicant records) at a major hospital with no patient-record impact — a useful reference case for vendor risk assessments covering HR/recruiting platforms, particularly in healthcare.
- Engineer — Skip
- SOC/IR — Learn: The attack vector — exploiting a third-party service provider to reach bank customer accounts — is a useful case study in lateral trust abuse, but no IOCs, TTPs, or detection artifacts are available to act on.
- Leader — Learn: A €30M fraud executed through a service provider flaw reinforces third-party risk as a board-level concern; useful framing for vendor risk discussions, but no specific vendor exposure to assess here.
- Engineer — Skip
- SOC/IR — Learn: ShinyHunters claimed this breach in July; no IOCs or TTPs published yet, so no detection action is possible — file for actor-tracking context.
- Leader — Act: If RingCentral is in your vendor stack, confirm scope with your account rep, request their incident report, and assess whether affected data triggers customer or regulatory notification obligations.
Act
archived
LexisNexis takes Diligence, Metabase API, Newsdesk offline after suspicious server activity
- Engineer — Skip
- SOC/IR — Learn: No IOCs, TTPs, or detection surface published; monitor for follow-up reporting that may yield hunt queries or indicators.
- Leader — Act: LexisNexis is a common enterprise vendor for due diligence and data enrichment — confirm this week whether your organization uses Diligence, Metabase API, or Newsdesk, and formally request a vendor incident report and data-exposure assessment.
- Engineer — Skip
- SOC/IR — Learn: No IOCs or TTPs published; breach occurred in October 2025 with delayed disclosure — useful context on healthcare software supply-chain exposure but no detection action available.
- Leader — Act: If your organization uses Unlimited Technology Systems or any of their healthcare software products, confirm exposure this week and request an incident report; the 3.8M-record scale and healthcare data sensitivity may trigger notification obligations or customer questions.
- Engineer — Skip
- SOC/IR — Learn: No IOCs or TTPs published; this breach offers no immediate detection surface, but it reinforces the pattern of healthcare billing vendors as high-value targets worth monitoring for sector-specific threat campaigns.
- Leader — Act: If your organization uses MCBS or similar third-party medical billing vendors, confirm whether you are among the 1.26M affected and request an incident attestation letter; this breach carries HIPAA notification obligations and may prompt patient or board inquiries.
- Engineer — Skip
- SOC/IR — Learn: No IOCs or TTPs disclosed; breach at a logistics vendor with no actionable detection surface for enterprise defenders at this time.
- Leader — Act: If OnTrac is in your vendor portfolio or used by employees for business shipments, confirm exposure scope and request an incident report from OnTrac this week before customer or leadership questions surface.
- Engineer — Learn: The entry point was a data exchange platform shared with a supplier, reinforcing that third-party integrations need isolation and least-privilege access. No specific CVE or software named, so no patch action available.
- SOC/IR — Learn: Confirms Everest ransomware gang is active and targeting supplier-connected platforms, but no IOCs or TTPs are published here to hunt on. File for actor-tracking context.
- Leader — Learn: Illustrates how a shared supplier portal becomes a ransomware entry point — a useful data point for third-party risk reviews and board-level ransomware briefings. No direct vendor relationship requiring immediate action for most organizations.
- Engineer — Skip
- SOC/IR — Learn: The breach originated through a third-party support ticketing system, illustrating a lateral entry path worth reviewing in your own vendor-managed tool integrations — no IOCs or TTPs published to act on yet.
- Leader — Act: If EY is a vendor or auditor your organization uses, confirm whether your data was in scope and request EY’s incident report; brief leadership now, before this becomes a customer or auditor question.
- Engineer — Skip
- SOC/IR — Skip
- Leader — Learn: A genetic-data breach resulting in an $18M multistate AG settlement illustrates the regulatory and financial exposure from third-party vendors handling sensitive biometric/health data — useful context for vendor risk assessments and board-level privacy risk discussions.
- Engineer — Skip
- SOC/IR — Skip
- Leader — Learn: A named retailer’s breach traced to an unnamed service provider is a clean case study for third-party risk reviews; no specific vendor is identified in reporting, so no immediate exposure check is actionable, but it reinforces the value of contractual breach-notification SLAs with SaaS and logistics vendors.