Third-party risk is the cyber exposure an organization inherits through vendors, suppliers and partners that can reach its data or systems. When one of them is breached, the attacker can follow that trusted access to every customer. This post explains how that cascade works, the entry points seen in 2025, two cases, and what a continuous program looks like.
Your perimeter is hardened. Your internal systems are patched. Your SOC monitors every endpoint. And then a company you have never heard of, an HR software vendor used by one of your procurement partners, gets breached. Days later, your employee records are on a dark web forum.
This is not a hypothetical. In 2025, supplier breaches reached customers in retail and in finance, and the two cases below show how.
Third-party risk is no longer a compliance category. It is the primary attack surface for the most impactful cyber incidents of the current era. And the majority of organizations are still trying to manage it with annual questionnaires.
This blog explains:
- what third-party risk is and how it actually propagates
- the attack vectors most commonly exploited in 2025
- two major 2025 cases that illustrate how supplier vulnerabilities cascade
- what a continuous third-party risk program looks like in practice
What Is Third-Party Risk, and Why Does It Cascade?
Third-party risk refers to the cyber exposure that an organization inherits through its relationships with vendors, suppliers, partners, and service providers. Every business relationship that involves access to your data, systems, or infrastructure is a pathway, however indirect. An attacker can use it to reach you without ever targeting you directly.
What makes this structural problem so difficult to manage is scale and depth. Most large organizations maintain direct relationships with hundreds of vendors. Those vendors maintain their own vendor ecosystems. Fourth-party and fifth-party dependencies extend the risk surface far beyond what any questionnaire-based program can map.
The cascade mechanics are straightforward. A threat actor does not need to breach your network. They breach a vendor who has privileged access to your systems, handles your data, or operates infrastructure you depend on. From that position, they reach you through the trusted relationship that your organization itself established.
The vendor can also be code that runs on your own pages. In October 2026 Polymarket paused trading after a compromised third-party provider hit its international site, four months after a similar vendor incident.
Third-Party Breach vs. Direct Attack: A Critical Distinction
| Direct Attack | Third-Party Breach | |
| Target | The organization itself | A trusted vendor or supplier |
| Attacker entry point | Your perimeter, employees, systems | Vendor’s systems, software, or infrastructure |
| Your visibility | High — it’s your own environment | Low — often zero until vendor discloses |
| Detection speed | Faster — your tools monitor your environment | Slower — breach occurs outside your visibility |
| Scale of impact | One organization | One vendor compromise can affect many downstream organizations |
| Your defensive control | Direct — you can patch, monitor, respond | Indirect — you rely on vendor security posture |
Why Attackers Prefer the Vendor Route
The economics are simple: attacking one organization directly requires significant effort and investment for a single target. Compromising one vendor that serves 400 organizations achieves 400 times the return on the same investment. The asymmetry is structural. Defenders must secure every connection across their entire vendor ecosystem. Attackers need only find one gap in one vendor.
This is exactly why third-party breach rates have doubled in a single year. Attackers have rationally calculated that vendor ecosystems are the highest-yield attack surface available to them, and 2025 case data confirms their calculation is correct.
| 💡 The Trust Paradox The same trusted access that makes a vendor relationship operationally valuable makes it dangerous when the vendor is compromised. You granted that access deliberately, and the attacker inherits it without needing to defeat any of your own security controls. Your perimeter never saw the attack coming because it never touched your perimeter. |
How Do Third-Party Breaches Actually Happen? The 2025 Attack Vector Map
Not all third-party relationships carry equal risk, and not all attack vectors are equally common. The 2025 breach data reveals four dominant entry points that security and risk teams should prioritize.
Ransomware Against Shared Service Providers
Some vendors run a shared service platform that provides centralized infrastructure to many clients at once. A single ransomware attack against such a vendor cascades automatically. Clients do not need to be individually targeted. They inherit the disruption, the data exposure, and the extortion pressure through their service dependency.
This attack pattern is particularly acute in sectors where shared platforms handle operationally critical functions: HR systems, payroll, logistics management, and compliance reporting. A ransomware group that compromises one such platform immediately holds leverage over every organization dependent on it.
OAuth Token and SaaS Integration Abuse
Modern enterprise environments are densely connected through application integrations. Suppose organization A grants application B access to its systems through OAuth tokens. If application B is later compromised, the attacker inherits those tokens. No credentials from organization A’s own infrastructure are needed.
In 2025, this attack vector caused some of the highest-volume third-party breach events. A single compromised integration gave access to hundreds of downstream organizations at once. The attacker’s leverage scales with the number of organizations that had granted the compromised application access.
Software Vulnerability Exploitation in Widely Deployed Platforms
A vulnerability may be discovered in enterprise software that thousands of organizations use. Attackers can then exploit it systematically. Each vulnerable installation is a separate breach, with minimal extra effort per target. The exploitation scales with deployment breadth, not with attack sophistication.
The most impactful third-party breaches of 2025 followed this pattern. They used zero-day or n-day vulnerabilities in enterprise platforms with broad deployment, exploited before patches could be deployed at scale. The vendor’s responsibility was to patch. The downstream organization’s exposure depended on how quickly it could apply the patch, or on whether the vendor had disclosed the vulnerability before exploitation began.
Non-Technology Vendor Compromise
Not every third-party breach originates from a technology supplier. Procurement partners, facilities management vendors, consulting firms, and professional services providers all maintain some form of access to organizational systems or data. When these non-technology vendors are compromised, attackers use that access to reach the primary target.
This category is the most frequently overlooked in formal vendor risk programs, precisely because the relationship does not appear to carry technical access. But a procurement vendor that handles supplier contracts has access to financial terms, counterparty identities, and operational details. These are highly valuable to threat actors. A facilities vendor with building management system access may have network adjacency that creates pivot opportunities.
2025 Case Studies: When the Supplier’s Problem Became Everyone’s Problem
| CASE STUDY 1 | April 2025 // Retail Sector // Third-Party Contractor Exploitation Marks & Spencer: A Third-Party Contractor Entry Point and a £300M Operating Loss |
In 2025, Marks & Spencer was hit by a ransomware attack that halted online shopping for a time.
The attackers, operating under the DragonForce ransomware group, reached M&S’s internal environment through social engineering aimed at employees of a third-party contractor.
The impact extended far beyond a typical data breach. Logistics disruptions cascaded into stock availability failures across stores. Waste increased as perishable goods could not be routed efficiently. E-commerce operations were partially suspended. The final financial assessment placed the estimated operating profit impact for 2025 and 2026 at approximately £300 million, equivalent to roughly $400 million USD.
The M&S case illustrates a pattern that appears repeatedly in high-impact third-party breaches. The entry point was a third-party contractor relationship, not a direct attack on M&S’s own infrastructure. The attackers used social engineering against contractor staff, a weakness that technical controls on M&S’s own network would not have shown.
💡 Key Lesson: Contractor Access Is the Perimeter The M&S breach entered through trusted third-party contractor access. The attacker did not need to defeat M&S’s perimeter security directly. They used a vendor’s credentials and access to walk through a door that M&S had opened legitimately. Until organizations treat contractor and vendor access with the same rigor as employee access, this entry point will remain available.
| CASE STUDY 2 | June 2025 // Financial Sector // Procurement Vendor Cascade Chain IQ Group: One Procurement Vendor, 19 Other Companies, Over 100,000 UBS Employees |
In June 2025, Chain IQ Group AG, a Switzerland-based procurement services provider, suffered a sophisticated cyberattack. Chain IQ operated as a shared procurement platform for a number of major financial institutions. It provided centralized procurement infrastructure and data management across its client base.
INCIBE-CERT reports that data was taken from Chain IQ and that 19 other companies were affected. INCIBE-CERT reports that more than 100,000 UBS employees had data exposed, mainly business contact details such as phone numbers.
Among the confirmed victims were employees of major financial institutions. The exposed data was sensitive beyond employee contact information. Workplace location codes and organizational metadata reveal internal structure. Threat actors use this to craft targeted spear-phishing campaigns against high-value individuals. The incident also exposed what appeared to be direct contact information for C-level individuals at client firms. Independent journalists who examined the leaked dataset later verified this information. Senior staff are a common target for this kind of follow-on phishing, as why protecting C-level (VIP) staff matters explains.
| 19 financial sector client organizations breached through a single shared procurement vendor | 130K+ employee records exposed and uploaded to dark web within hours of initial access | 0 technology vulnerabilities required by the attackers; the access was through the vendor relationship itself |
The Chain IQ incident is a particularly instructive example of the non-technology third-party risk category. Chain IQ was not a cybersecurity vendor, not a cloud services provider, and not a software company. It was a procurement services firm. Its clients’ main exposure did not come from a software vulnerability or technical misconfiguration. It came from the access and data they had entrusted to a service provider in a normal business relationship.
| 🔴 Key Lesson: Procurement Vendors Are Not Low-Risk Organizations routinely apply lower security scrutiny to non-technology vendors than to software or cloud providers. Chain IQ demonstrates why this assumption is wrong. A procurement vendor handles supplier contracts, organizational data, employee information, and financial terms. When that vendor is compromised, everything it handles becomes available to the attacker. The sensitivity of the data and access a vendor holds sets the risk level of the relationship. The technology category of its services does not. |
Why Can’t Traditional Third-Party Risk Management Keep Pace?
Most organizations have some form of third-party risk management program. The majority of those programs were designed for a threat environment that operated at a different speed and scale. Annual questionnaires, periodic assessments, and compliance checklists were adequate controls when supply chain attacks were occasional and their impact was contained. They are structurally inadequate now. Third-party breach rates are doubling year-over-year, and a single vendor compromise can cascade to hundreds of downstream organizations within hours.
The Questionnaire Problem
Vendor security questionnaires are self-reported assessments completed by the vendor and reviewed by the organization’s risk team. They are periodic rather than continuous. They are self-reported rather than independently verified. They also do not detect vulnerabilities or active compromises that occur between assessment cycles. A vendor that returned a clean questionnaire in January is not necessarily less compromised in August. The questionnaire cannot tell you that.
The Scale Problem
A mature enterprise maintains relationships with hundreds of direct vendors. Each of those vendors maintains its own vendor ecosystem. The total vendor surface to monitor includes fourth-party and fifth-party dependencies. It is orders of magnitude larger than any questionnaire-based program can practically cover. Continuous automated monitoring is the only operationally viable approach to this scale.
🔍 From Periodic Assessment to Continuous Intelligence The organizations that avoided becoming downstream victims in the highest-impact 2025 third-party breaches were not those with more thorough questionnaires. They were those with continuous external monitoring. This gave them real-time visibility into vendor security posture changes. It also gave them dark web signals of vendor credential exposure and threat intelligence when vendors were being actively targeted. Static assessment cannot compete with dynamic attack.
How Do You Build a Third-Party Risk Program That Matches the 2025 Threat?
Effective third-party risk management in the current environment is not a questionnaire process. It is a continuous intelligence program with three layers. They are vendor inventory and tiering, continuous external monitoring, and contractual controls with tested incident response.
| LAYER 1: VENDOR INVENTORY AND RISK TIERING |
| Maintain a complete, current inventory of all third-party relationships: technology and non-technology vendors, subsidiaries, acquired entities, and fourth-party dependencies for high-tier relationships. |
| Tier vendors by risk level based on data access, system integration depth, and operational criticality. Apply different monitoring rigor and assessment frequency to each tier. A procurement vendor with access to employee data requires the same scrutiny as a cloud infrastructure provider. |
| Extend vendor inventory to fourth-party relationships for critical vendors: map your most important vendors’ own critical vendor dependencies. |
| LAYER 2: CONTINUOUS EXTERNAL MONITORING |
| Monitor vendor external attack surfaces continuously: exposed assets, unpatched services, certificate anomalies, and misconfigured cloud resources. Security posture can degrade significantly between annual assessments without any internal indicator. |
| Monitor dark web sources for vendor credential exposure. When vendor employee credentials appear in stealer logs or combolist distributions, your organization is at risk before any technical breach has occurred at your systems. |
| Track vulnerability disclosures for software products in your vendor ecosystem, particularly enterprise platforms with broad deployment footprints. Early awareness of exploitation campaigns provides a response window that periodic assessments cannot offer. |
| Monitor ransomware group activity for targeting signals relevant to your vendor ecosystem and the sectors your critical vendors operate in. The 73-day disclosure gap means the signal often appears on dark web forums long before official notification. |
| LAYER 3: CONTRACTUAL CONTROLS AND INCIDENT RESPONSE |
| Include mandatory breach notification timelines in vendor contracts. Require vendors to notify you within 24 to 72 hours of discovering a security incident, rather than waiting for their own disclosure timeline. The 73-day median gap is partly a contractual failure. |
| Require vendors to maintain minimum security controls as a condition of contract: MFA enforcement, vulnerability management cadence, and incident response capability. Make security a buying criterion that vendors must demonstrate, not merely attest to. |
| Develop vendor-specific incident response playbooks for critical vendors. These are pre-defined steps for when a critical vendor is breached, including data isolation, alternative sourcing, and regulatory notification procedures. |
| Conduct tabletop exercises that simulate third-party breach scenarios. Include scenarios where you learn of a vendor breach through a dark web monitoring alert rather than an official vendor notification. The M&S and Chain IQ cases both demonstrate that the signal often arrives through external channels before the vendor discloses. |
How Brandefense Provides Continuous Third-Party Risk Intelligence
Brandefense’s External Attack Surface Management and Digital Risk Protection platform extends your security visibility beyond your own perimeter. It continuously monitors your vendor ecosystem and the threat intelligence signals that come before third-party breach events.
| Brandefense Capability | What It Detects in Third-Party Risk Scenarios |
| Vendor External Attack Surface Monitoring | Continuous discovery and assessment of your critical vendors’ externally exposed assets. These include open ports, unpatched services, misconfigured cloud resources, and certificate anomalies that indicate security posture degradation between formal assessments. |
| Dark Web Vendor Credential Monitoring | Real-time scanning of stealer logs and credential markets for your vendors’ employee credentials. When a vendor’s staff credentials are compromised, your organization’s data and access are at risk before any technical breach occurs at your systems. |
| Ransomware Group Targeting Intelligence | Monitoring of ransomware group dark web activity and sector-specific targeting patterns relevant to your vendor ecosystem. Early warning when groups are focusing on suppliers or software platforms in your supply chain. |
| Vulnerability Exploitation Intelligence | Early warning when threat actors are actively exploiting vulnerabilities in software your vendors deploy. It provides a response window before mass exploitation reaches your specific vendor relationships. |
| Leak Site Monitoring | Continuous monitoring of active ransomware data leak sites for your vendors’ names. It detects vendor breach disclosures before official notification, often while the incident is still in progress or within hours of data publication. |
| Supply Chain Risk Alerting | Automated alerts when any monitored vendor shows signals of active compromise, targeted attack, or significant security posture degradation. This enables a proactive response rather than reactive notification processing. |
| 24/7 Analyst Coverage | AI does the work and analysts verify critical findings; escalation protocols for high-severity vendor incidents that require immediate organizational response before formal disclosure arrives |
The organizations that avoided becoming downstream victims in 2025’s highest-impact supply chain incidents were not those with the most thorough annual assessments. They were those with the earliest warning. Their continuous external monitoring surfaced vendor credential exposure, attack targeting signals, and vulnerability exploitation activity. It did so before the breach notification arrived, or before the breach was even disclosed.
Third-party risk is not a compliance problem. It is a visibility problem. And the 73-day gap between breach and disclosure is not a timeline your security program can afford to wait through.
