Third-party - FrontierZero Learning Center

The Modern Blindspot: How Two Companies Lost 400,000 Customer Records Without Getting Hacked

Bol and De Bijenkorf just disclosed a massive breach. 400,000+ customers. Names, addresses, phone numbers, order history. Already for sale on the dark web. Here's the terrifying part: Their systems were never touched. Clean firewalls. Perfect security posture. Yet customer data walked out the back door. CEVA

Third-party

The $300B Company’s Blind Spot: How Amgen's Perfect Security Posture Became Worthless

Amgen just got breached. Patient data stolen. Proprietary research gone. Financial records exfiltrated. Material incident. SEC filing. Notification letters to patients. The world's leading biotech company with over $300 billion in market cap, world-class security teams, compliance certifications, audits, controls just got hit. Now here's the

Third-party

Lidl Breached Through External Service Provider

What Happened Customer names, birthdates, email addresses, phone numbers, and IDs stolen. Lidl's own infrastructure stayed intact. The data was stored by an external service provider handling customer information on their behalf. How They Got In Attackers gained access to a file stored by the contracted service provider.

Third-party Featured

It Can't Go On Like This, Can it? It Can! EY Just Got Breached.

Their firewalls held. Their endpoint detection was solid. Their identity management locked down. Everything worked exactly as designed. But on July 13, 2026, Ernst & Young sent notification letters to affected clients anyway. Millions of dollars in sensitive tax documents and financial records had been stolen. Here's what

Third-party Featured

The Best Third-Party Risk Management Tools for GCC Companies in 2026

Third-party breaches are now the leading attack vector in enterprise security. Not phishing. Not ransomware. Third parties. Verizon's 2025 Data Breach Investigations Report confirmed what GCC CISOs have been sensing for two years: 48% of all breaches now involve a third party, up 60% year-over-year. One in two

Third-party

Polymarket Lost $3 Million in a Third-Party Vendor Breach: What It Means for Your SaaS Stack

Polymarket didn't get hacked. Their vendor did. Here's what the $3 million breach reveals about the third-party risk trend, and the connections most companies don't know they have.

Third-party

EY Breached Through Third-Party Support Ticket System

What Happened Client tax documents and financial data downloaded from a third-party IT support ticket system. The platform stored sensitive information from tax-related support requests. EY's own systems stayed intact. The breach happened at the vendor. How They Got In An unauthorized third party accessed the support platform

Third-party

LastPass Breached Through Third-Party Connection Klue

What Happened LastPass customers' data stolen. CRM records, emails, phone numbers, authentication details, all walked out the door. LastPass's own security stayed clean. The breach happened at a vendor connected to their Salesforce. How They Got In Klue, a market intelligence platform, was compromised via a legacy

Cybersecurity Featured

We Read All 121 Pages of the 2026 Verizon DBIR So You Don't Have To

The 2026 Verizon DBIR Is Out. Here's What The Data Actually Says.

Third-party Featured

Oxford University Suffered Two Third-Party Data Breaches in One Term. Here Is What Actually Happened.

Oxford's own systems held. Their vendors didn't. Two third-party breaches in one academic term, and no independent detection capability in either case. A full technical breakdown.

Third-party

Deutsche Bank Breached Through External Vendor

What Happened Employee data stolen through an external service provider - a marketing and incentive platform. Email addresses, password hashes, physical addresses, internal database records all exposed. Deutsche Bank's own systems untouched. The breach happened at the vendor. How They Got In Ransomware group Unsafe compromised the external

Product Comparison Featured

SecurityScorecard Gives You the Outside View. Here's What It Can't See.

SecurityScorecard earns its place in vendor risk programmes. But once a vendor connects to your SaaS environment, the outside view goes dark. That is where most modern third-party breaches actually unfold.

Third-party Featured

BitSight Monitors Your Vendors From the Outside. Someone Needs to Watch the Inside.

BitSight has earned its place in vendor risk programmes worldwide. But there is a layer it was never built to see: what happens after a vendor connects to your SaaS environment. This is the gap where most modern third-party breaches actually occur, and where external security ratings go silent.

Roundtables

What Security Leaders Said Behind Closed Doors

A room of CISOs and legal experts. No vendor pitches, no slides. What they said about the monitoring gap in enterprise security was more direct than most things published in this space.

Third-party

Zara Breach Explained: Here's The Hacker Playbook for 2026

ShinyHunters didn't hack Zara, Vimeo, and Rockstar separately. They compromised one vendor and got all three. Here's the exact playbook they used.

SaaS Security

The Third-Party Breach List Keeps Growing. Vimeo is the latest to join.

Vimeo was breached through Anodot, a third-party analytics tool. So was Rockstar Games. Same vendor, same month. This is no longer a pattern. It's the playbook.

Third-party Featured

Rockstar Breach Explained: 78.6 Million Records. Zero Alarms. One Unmonitored Vendor.

Rockstar wasn’t breached through their own systems. Attackers compromised a vendor, used legitimate access into Snowflake, and walked away with 78.6 million records, without triggering a single alert.

Third-party Featured

The Side Door Problem: What the HackerOne Breach Tells Us About Third-Party Risk

HackerOne wasn’t breached directly. A supplier was. One vulnerability exposed millions across multiple organisations. This is how modern attacks really happen, and why most companies still don’t see the risk.

Cybersecurity

The Crunchyroll Breach Explained: How a Vendor Login Exposed 6.8M Users

Attackers didn’t breach Crunchyroll’s systems, they logged in through a compromised vendor account. The incident highlights a growing risk: third-party access across SaaS environments.

SaaS Security

The Vendor You Trusted Just Exposed 25 Million People

A breach at Conduent exposed the data of 25 million Americans after attackers remained inside the vendor’s systems for three months.

Shadow IT

Your AI Tools Have More Access Than You Think.

AI tools are spreading across organizations faster than most security teams can track. Each OAuth login or SaaS integration can quietly create persistent access to company data, often without centralized visibility.