Third-Party Data Services Bring Supply Chain and Breach Risks
Summary
An overview of security risks when organizations entrust data to third parties, with breach examples and advice on assessing vendor security, access controls, encryption, and cloud visibility.
Key points
- Third-party data services can improve accessibility, collaboration, and reliability, but reduce an organization’s control over data and increase exposure to supply chain risks.
- A successful attack on a service provider can affect multiple clients. The article cites stolen student data from 23 US school districts in the Illuminate Education incident.
- Risks include software supply chain attacks, human error, and misuse of privileged access.
- Organizations should assess vendors’ data retention, encryption, and identity and access practices, and clarify who is responsible for security in shared environments.
- The article cites research finding that organizations with extensive security AI and automation identified and contained breaches 108 days faster in 2023 than those without it.
- A May 2024 breach involving Australian provider Sumo reportedly exposed personal details of about 40,000 customers, including approximately 3,000 passport numbers; the article says an unnamed third party was blamed.
Article Details
- Topic
- Benefits and security risks of third-party data solutions, including supply-chain exposure, data breaches, and monitoring cloud environments.
Vendors
Amazon Web Servicesparties who handle an organization’s data can range from large public cloud providers such as Azure or AWS, to boutique companies who handle specific business functions such as telemarketing, payment systems, orDarktraceHow Darktrace helps monitor third-party data usageMicrosoft AzureThird parties who handle an organization’s data can range from large public cloud providers such as Azure or AWS, to boutique companies who handle specific business functions such as telemarketing, payment systems, or
Products
Countries
Industries
EducationFor example, when Illuminate Education was the target of a cyber-attack, the data of 23 US School Districts was stolen via its student-tracking software. It included student data from the country's two largest schoolEnergySumo, an Australian energy and internet provider, suffered a data breach which they became aware of on May 13th, 2024. Further investigation into the cyber incident has found that “the personal details of approximatelyGovernmentSimilarly, the UK’s Ministry of Defence was the victim of a data breach earlier this year when hackers targeted a third party payroll system used by the government department.Internet service providers