Your vendor may be the weakest link: Percentage of third-party breaches doubled in a year

The percentage of confirmed data breaches involving third-party relationships doubled last year as cybercriminals increasingly exploited weak links in supply chains and partner ecosystems.

That's according to Verizon's Data Breach Investigations Report (DBIR) —one of the industry's most-watched autopsies on what actually goes wrong in infosec. This year's edition, released Wednesday, covers incidents that occurred between November 1, 2023, and October 31, 2024.

It found that the proportion of breaches involving third parties rose from 15 percent in last year's dataset to 30 percent in this year's report. This figure includes those breaches (incidents in which data loss was confirmed) caused by exploited software vulnerabilities and supply chain compromises.

Ilia Kolochenko, CEO at ImmuniWeb and fellow at the British Computer Society, said during a launch event for the report that cybercriminals are increasingly looking at organizations such as accountants and law firms as ways to reach their intended targets.

"Criminals are smart and pragmatic; they count every cent and are cost-conscious," he said, explaining why more vulnerable companies can act as reliable gateways into much bigger target environments.

Verizon said that vendors and other business partners are expanding the attack surface by failing to enforce proper access controls, including preventing credential misuse. In particular, weak third-party practices continue to expose organizations to downstream risks.

One example: in third-party environments, the median time to remediate leaked secrets, such as API keys or tokens discovered in public GitHub repositories, was 94 days, giving attackers ample opportunity to exploit them.

Leaked secrets weren't the only problem. The report also highlights how credential reuse played a key role in several high-profile incidents, including a major Snowflake-related breach, where attackers used previously exposed credentials to access customer accounts due to the lack of mandatory multi-factor authentication (MFA).

Major organizations such as Santander and Ticketmaster got hit after threat actors from the ShinyHunters group used stolen credentials to access Snowflake customer accounts last summer, affecting hundreds of millions of records.

Verizon noted that it wasn't solely Snowflake's fault - roughly 80 percent of the affected customer accounts had previously exposed credentials, which amplified the fallout.

However, the lack of mandatory MFA across Snowflake accounts made the campaign particularly effective. This gap was one of the first things Snowflake moved to address after the incident.

"Only in a perfect world with no conflict of responsibilities would the challenge of securing infrastructure (or platform) as a service providers be the same as that of securing on-premise assets for areas they don't explicitly cover," the report reads. 

"That means managing credentials will likely be harder in an environment you don't control. Secure-by-default standards on those platforms make a significant difference in the security bottom line, as the quick post-incident policy updates from Snowflake would suggest."

Other major incidents involving software providers over the past year include CDK Global, Blue Yonder, and Change Healthcare. Verizon classified these as ransomware breaches that not only compromised of millions of personal records, but also triggered widespread business interruption for customers - particularly across healthcare, retail, and food service sectors.

Securing the source

Organizations looking to mitigate the risk of third-party breaches should be ensuring cybersecurity is treated as a priority during the procurement process, Verizon recommends.

That's not always possible for organizations with existing contracts, especially when there are no viable alternatives on the market. Even then, removing a deeply entrenched provider from an environment is an arduous task.

• American Express admits card data exposed and blames third party
• Law firm 'didn't think' data theft was a breach, says ICO. Now it's nursing a £60K fine
• Snowflake slams 'more MFA' button again – months after Ticketmaster, Santander breaches
• Mega US healthcare payments network restores system 9 months after ransomware attack

But during your next sales call, it may be worth asking vendors how they handle cyber hygiene and how they ensure access to data is limited. Then, during the contract-drawing phase, ensure the third party's responsibilities toward security are clearly codified. This will makes it easier to hold vendors accountable when things go sideways.

That's all in addition to ensuring the basics are covered: MFA by default, network segmentation, strict authentication policies, and API key aging.

In the end, some threats are impossible to avoid, but collaboration can help mitigate the risks. "At the end of the day, there is no simple or infallible method of avoiding some of the threats we discuss in this report," Verizon said. 

"Holding vendors accountable is certainly part of the equation. However, it is only through collaborating with transparency and increased information sharing that organizations can build good, structured frameworks for threat modeling, and as a result, make better and more sustainable decisions for safeguarding their data and the customers they serve." ®