Third-Party Data Breach

CriticalDevOps SecurityA06:2021 – Vulnerable and Outdated Components

A vendor, supplier, or partner experiences a security breach that exposes your organisation's data, creating regulatory obligations, reputational damage, and potential downstream compromise.

Immediate Response

1Activate the incident response team and engage legal counsel immediately.
2Determine what data was exposed and assess regulatory notification obligations.
3Revoke or restrict the third party's access to your systems pending investigation.
4Preserve all communications and evidence related to the breach.

All playbooks

1Conduct a forensic assessment of the third party's integration points.
2Rotate all credentials, API keys, and tokens shared with the affected vendor.
3Review and update data sharing agreements with security incident clauses.
4Notify affected individuals and regulators as required by applicable laws.

Long-term Prevention

1Implement a vendor risk management program with security assessments.
2Require third parties to maintain security certifications (SOC 2, ISO 27001).
3Apply data minimization principles to limit data shared with third parties.
4Maintain an incident response plan that covers third-party breach scenarios.

Attack vectors

Supplier's compromised infrastructure exposing shared data or API integrations
Third-party SaaS provider breach affecting your organisation's stored data
Supply chain attack through compromised software updates from trusted vendors
Business partner's weak security enabling lateral movement into your systems

Indicators of compromise

Vendor notification of a security incident affecting your data
Anomalous data access patterns from third-party integration endpoints
Your organisation's data appearing in breach databases or dark web forums
Regulatory inquiries or media reports about a vendor breach

Tooling

Vendor risk assessment platformsBitSightSecurityScorecardOneTrustCISA Supply Chain Guidance