#Third-Party Risk
All CosmicBytez Labs articles tagged #Third-Party Risk, across news, security advisories, how-to guides, and projects.
- News
When Your Ransomware Negotiator Works for the Other Side
Dark Reading's analysis of negotiator Edward Dubrovsky's arrest warns crisis urgency lets compromised IR vendors bypass normal vetting controls.
- News
FBI Blames Contractor's Missed Patch for ShinyHunters Breach of Employee Data
The FBI says an Accenture contractor's failure to patch an Oracle PeopleSoft system let ShinyHunters steal employee personal data.
- News
Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account
Attackers abused a Danish company's lawful CPR register access for 10 days in September, exposing names, addresses, and ID numbers for 8.8 million people.
- News
Frontline Education Breach Exposes School District Employee Data
Frontline Education is notifying districts that a third-party software flaw let attackers steal employee SSNs, emails, and addresses.
- News
BigCommerce Data Stolen via Ribon Apps Hack
A compromised BigCommerce application key held by third-party app Ribon exposed merchant customer data across affected storefronts.
- News
Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted
Trezor confirms ShipMonk's breach exposed 67,000 more customers via old records the fulfillment partner had assured were deleted, pushing the total to ~80,689.
- News
SickKids Hospital Hit by Cybercriminals Again as Employee Data Stolen
Canada's Hospital for Sick Children suffered a second cyber incident with employee data stolen via a compromised third-party app, four years after a 2022...
- News
SickKids Data Breach Exposes Employee and Job Applicant Info
Toronto's SickKids hospital disclosed a breach affecting current and former employees and job applicants via a third-party software flaw. Patients unaffected.
- News
U.S. Bank Says Breach Claims Related to Fourth-Party Incident
U.S. Bank confirmed exposure tied to a fourth-party vendor breach, stating no evidence of compromise to its own systems, networks, or data repositories.
- News
Heights Finance Data Breach Impacts at Least 1.2 Million Individuals
Hackers stole names, SSNs, and financial data from a Heights Finance third-party platform, affecting over 1.2 million customers.
- News
Pokemon Center Data Breach Exposes Customer Info, Cancels Some Orders
Pokemon Center is notifying UK and Germany customers of a third-party breach at logistics provider CEVA Logistics that exposed personal and order data.
- News
Hackers Arrested Over €30M Bank Fraud Exploiting Service Provider Flaw
Operation Klonen: Brazilian and German authorities arrest 7 suspects behind a €30M bank fraud exploiting a third-party payment processor vulnerability at...
- News
Amgen Cloud Breach Exposes Patient Health Data and Proprietary Research
Pharmaceutical giant Amgen disclosed a material data breach affecting cloud environments operated by third-party service providers, with threat actors...
- News
Origin Energy Data Breach Affects 900,000 Australians
Australian energy giant Origin Energy confirmed a data breach exposing the personal and partial financial information of approximately 900,000 current and...
- News
Ernst & Young Discloses Data Breach After Third-Party IT Support System Hacked
Ernst & Young is notifying customers of a data breach stemming from the compromise of a third-party support ticket system used by its IT personnel,...
- News
Lidl Discloses Online Shop Breach After Service Provider Hack
German supermarket giant Lidl has notified customers in Germany, Belgium, and the Netherlands that personal data was stolen following a breach at one of...
- News
Medtronic Notifies Customers Impacted by ShinyHunters Data Breach
Healthcare device giant Medtronic is sending breach notification letters to customers after ShinyHunters gained unauthorized access to personal data held...
- News
More Klue Breach Victims Identified as Hackers Get Hacked
Roughly two dozen companies have notified their customers of impact from the Klue-Salesforce breach incident — a cascade that now includes the hackers...
- News
Nintendo Confirms Employee Data Stolen in TinyPulse Cyberattack by Shadowbyt3$
Nintendo of America has confirmed that approximately 1GB of employee data — including W-9 forms, bank statements, and HR survey responses — was...
- News
Oncology Institute Discloses Data Breach
An unnamed oncology institute has disclosed a data breach originating from a third-party vendor compromise, with TriZetto cited as one possible candidate.
- HOWTO
Why Your Accountant is a Ransomware Target
Small accounting firms in rural Alberta have become primary ransomware targets in 2025–2026. The reasons are structural: high-value data, weak security…
- News
SecurityScorecard Acquires Driftnet to Boost Third-Party
SecurityScorecard has acquired Driftnet to expand visibility into third-party ecosystems, addressing growing supply chain attack risks that continue to...
- News
Video Service Vimeo Confirms Anodot Breach Exposed User Data
Vimeo has confirmed that customer and user data was accessed without authorization following a security breach at Anodot, a data anomaly detection...
- News
Vercel Breach Tied to Context AI Hack Exposes Limited
Vercel's security breach originated from the compromise of Context.ai, a third-party AI tool used by a company employee, allowing attackers to gain...
- News
Vercel Employee's AI Tool Access Led to Data Breach
Stolen OAuth tokens from a compromised employee AI tool enabled attackers to pivot into Vercel's internal systems. Security researchers warn that...
- News
Hims & Hers Warns of Data Breach After Zendesk Support
Telehealth giant Hims & Hers Health is warning customers of a data breach after support tickets were stolen from a third-party customer service platform,...
- News
Marquis Ransomware Breach: 672K People Exposed as Attack
Texas fintech Marquis Software Solutions has confirmed a ransomware attack in August 2025 exposed data of 672,000+ individuals and disrupted operations at...
- News
Ericsson US Discloses Data Breach Affecting Employees and Customers
Ericsson's U.S. subsidiary has disclosed a data breach after attackers hacked a third-party service provider between April 17–22, 2025, exposing names,...