Third-party ecosystems are structurally exposed.
Black Kite’s 2026 report reframes supply chain cyber risk from “weakest link” theory to concentration dynamics.

Key systemic indicators:
• 5.28 downstream victims per breach (2025 average)
• 10-day median detection vs. 73-day median disclosure
• 53%+ organizations with at least one critical vulnerability
• 23%+ with corporate credentials exposed

Top 50 shared vendors:
– 70% KEV exposure
– 84% CVSS ≥ 8
– 62% stealer-log credential presence
– 52% breach history

Shared infrastructure nodes are now strategic attack surfaces.
Security teams must shift toward:
Dependency mapping
Concentration analytics
Active intelligence monitoring
Exposure propagation modeling
Is your organization modeling systemic fragility — or auditing in isolation?

Source: https://blackkite.com/press-releases/black-kites-2026-third-party-breach-report-identifies-risk-concentration-as-the-primary-catalyst-for-global-cascading-failures

Engage below.
Follow TechNadu for advanced infosec, vendor risk, and threat intelligence coverage.

#Infosec #ThirdPartyRisk #VendorSecurity #ThreatIntelligence #CISAKEV #CyberExposure #Ransomware #SupplyChainSecurity #SecurityEngineering #CyberResilience #RiskAnalytics

Third-party breach, 38M impacted, European e-commerce sector.
ManoMano disclosed unauthorized access linked to a subcontracted customer support provider. Exposed data reportedly includes PII and support communications.
Authorities notified: CNIL, ANSSI.
Passwords not reportedly accessed.
Subcontractor access revoked.

Key risk vectors:
– SaaS support platforms
– Vendor access governance
– Over-retention of ticketing data
– Centralized customer communication logs
– Supply chain attack surface expansion

This case reinforces that vendor monitoring must go beyond contractual clauses — continuous assessment, least privilege enforcement, data minimization strategies.

How mature is your third-party risk telemetry?
Engage below.

Source: https://www.bleepingcomputer.com/news/security/european-dyi-chain-manomano-data-breach-impacts-38-million-customers/

Follow @technadu for high-signal infosec reporting.

Repost to amplify awareness across the security community.

#Infosec #ThirdPartyRisk #VendorSecurity #SupplyChainSecurity #DataBreach #GDPRCompliance #EcommerceSecurity #CyberRiskManagement #SecurityOperations #GRC

Adidas probes third-party breach after Lapsus$ Group actor claims 815K records stolen.
Supply chain exposure in focus.

https://www.technadu.com/adidas-data-breach-investigation-underway-following-third-party-intrusion-claims-by-lapsus-group/620523/

#Infosec #DataBreach #ThirdPartyRisk

700+ passport scans exposed via unsecured cloud server at Abu Dhabi Finance Week.
Third-party vendor misconfiguration blamed.

🔗 https://www.technadu.com/abu-dhabi-finance-week-data-leak-exposes-global-figures-passport-information-in-cloud-server-lapse/620424/

#DataBreach #CloudSecurity #ThirdPartyRisk #InfoSec

Volvo employee data exposed after Conduent HR breach.

• 16,991 health plan files accessed
• SSNs + medical data potentially exposed
• 3-month attacker dwell time
• SafePay claims 8.5TB stolen

Supply chain ransomware impact continues to scale.

https://www.technadu.com/automotive-giant-volvo-employee-information-exposed-via-third-party-conduent-data-breach/619829/

#DataBreach #Ransomware #ThirdPartyRisk #InfoSec

Flickr disclosed potential user data exposure after a vulnerability in a third-party email provider.
Names, emails, IPs possibly affected; passwords not exposed.

https://www.technadu.com/flickr-discloses-potential-data-exposure-following-third-party-email-provider-vulnerability/619653/

#InfoSec #DataBreach #ThirdPartyRisk

Coinbase has confirmed an insider-related incident involving improper access to customer support tools by a contractor, impacting approximately 30 users.

The case reinforces a recurring security theme: third-party and BPO access continues to be a high-value target, often exploited through insider misuse rather than technical vulnerabilities.

As more organizations externalize support operations, visibility, least-privilege enforcement, and insider threat detection remain critical control points.

💬 How are teams effectively reducing BPO insider risk today?

Source: https://www.bleepingcomputer.com/news/security/coinbase-confirms-insider-breach-linked-to-leaked-support-tool-screenshots/

➕ Follow @technadu for sober, detail-oriented infosec coverage

#Infosec #InsiderThreat #ThirdPartyRisk #BPO #Coinbase #SecurityOperations

An alleged ransomware incident involving Apple partner Luxshare highlights ongoing supply-chain exposure risks.

RansomHub claims access to internal engineering data, though details remain unverified and no confirmation has been issued by the company.

The case reinforces the importance of third-party risk management, incident verification, and measured public communication.

Follow TechNadu for factual, non-speculative cybersecurity reporting.

#Infosec #Ransomware #SupplyChainSecurity #ThirdPartyRisk #CyberSecurity #TechNadu

🔗 Supply Chain Attacks Put Businesses at Risk
Attackers often enter through vendors or partners, not directly. One weak link can expose your entire organisation — secure third-party access and integrations. 🔐

#CyberSecurity #SupplyChainSecurity #ThirdPartyRisk #InfosecK2K