Supply chain, OAuth and OT failures defined the late September breach wave

At a glance

What this is: This weekly intelligence report ties several late-September 2025 incidents to supply-chain exposure, compromised OAuth access, ransomware, and exploited vulnerabilities.

Why it matters: It matters to IAM practitioners because the incidents show how delegated access, third-party integrations, and privileged credentials can turn routine business connectivity into systemic risk.

By the numbers:

• Stellantis disclosed unauthorized access to 18 million North American customer records.
• A takedown operation disrupted a phishing service that stole over 5,000 Microsoft 365 credentials.

👉 Read FireCompass's weekly cybersecurity intelligence report on late-September breaches

Context

Late-September breach reporting keeps reinforcing the same operational gap: organisations still trust identity and third-party access paths that attackers can abuse faster than teams can detect them. In this report, the primary issues are not isolated malware events but the combination of credential compromise, delegated access, supplier exposure, and weak containment across business-critical systems.

For IAM and security teams, the important question is not only who was breached, but which access paths made the breach possible and allowed it to spread. The incidents here span human identity compromise, OAuth token abuse, third-party processor exposure, and privileged access failure, which makes the report relevant to both human IAM and non-human identity governance.

Key questions

Q: How should security teams reduce the blast radius of privileged identities?

A: Security teams should define a small set of tightly governed admin identities, give them the minimum authority needed, and make elevation time bound. The goal is to prevent one compromise from cascading across identity, device, and SaaS control planes. Continuous review of who can administer what is more important than periodic access cleanup.

Q: Why do OAuth sessions create more risk than traditional login events?

A: OAuth sessions can carry trust forward after the initial authentication step, which means one successful approval can unlock access across multiple services. That makes the session itself a governance object. The risk grows when token reuse, brokered apps, or consented scopes let the original access fan out beyond the original user intent.

Q: What are the warning signs that third-party access has become a security problem?

A: Watch for integrations that were created quickly, rarely reviewed, or granted broad data export rights. Other warning signs include tokens that survive staff changes, processor accounts with no owner, and supplier access that is not tied to a clear business task. Those conditions often turn trusted connectivity into hidden exposure.

Q: Should organisations treat ransomware, supplier compromise, and token abuse as one governance issue?

A: Yes, because all three usually exploit trust that was granted for business operations. The control question is not which attack arrived first, but whether the identity or integration behind it had more access than it needed. Unified governance across human identity, NHI, and recovery planning reduces the chance that one incident becomes enterprise-wide disruption.

Technical breakdown

How spear phishing and credential compromise become initial access

The report’s aviation and manufacturing incidents show a familiar pattern: an attacker starts with a deceptive message, then uses that foothold to obtain credentials or execute malicious code. Spear phishing remains effective because it targets the human decision point before technical controls engage. Once a valid session or trusted attachment is accepted, the attacker can move into internal systems, often bypassing perimeter controls that assume authenticated traffic is legitimate.

Practical implication: strengthen identity-bound entry controls such as phishing-resistant authentication and tighter attachment and domain validation.

Why OAuth token abuse is especially hard to contain

OAuth tokens are delegated authorisations, not passwords, which means they can persist beyond the original login event and often carry broad API scope. In the Stellantis case, compromised tokens from a third-party integration enabled authorised API calls and bulk data export without a traditional interactive login. That makes token scope, revocation, and integration oversight central security controls rather than administrative details.

Practical implication: treat OAuth tokens as high-value secrets and enforce scope limits, rotation, and rapid revocation pathways.

How ransomware converts access into operational disruption

Ransomware becomes more damaging when attackers pair encryption with credential access, privilege escalation, and lateral movement. In the Collins Aerospace incident, the attack disrupted airport operations because the malware reached passenger processing software and associated databases, forcing manual fallback procedures. That is a reminder that operational resilience depends on segmentation, recovery planning, and control of privileged pathways, not just malware detection.

Practical implication: segment critical operational systems and test manual fallback processes before an incident forces them into use.

Threat narrative

Attacker objective: The attacker objective was to turn trusted access paths into leverage for encryption, data theft, or operational disruption at scale.

1. Entry occurred through spear-phishing, compromised third-party access, or exploitation of unpatched services, depending on the incident in the report.
2. Escalation followed when attackers used valid credentials, OAuth tokens, or vulnerable gateways to reach privileged systems and internal data stores.
3. Impact came through ransomware encryption, bulk data exfiltration, or outage of operational systems that forced manual or fallback processes.

NHI Mgmt Group analysis

Identity compromise is now an enterprise intrusion path, not just a credential problem. The report spans phishing, OAuth abuse, supplier compromise, and privileged access failure, which are different entry methods but the same governance weakness. Once a trusted identity path is abused, the attacker inherits the trust that normal operations depend on. For IAM and PAM teams, that means access governance must be treated as an operational control plane, not a back-office policy function.

Third-party access is still being managed as a static trust relationship when it behaves like a dynamic attack surface. The Harrods and Stellantis cases show how supplier integrations and delegated permissions can become the shortest path to customer data. This is where NHI governance matters as much as human IAM, because API tokens, service connections, and processor access often outlive the business justification that created them. Practitioners should align supplier access reviews with lifecycle controls, not annual checkbox assurance.

Blast radius control is now the deciding metric for breach impact. The aviation and manufacturing incidents show that once attackers reach a critical system, business continuity becomes a control outcome rather than an IT recovery problem. Access path compression: limiting how many identities, integrations, and privileged routes can reach a critical asset reduces the number of ways an attacker can turn one foothold into a major event. Teams should measure that compression explicitly.

Security teams should read the report as evidence that identity telemetry and operational telemetry need to converge. Ransomware, supplier compromise, and token abuse all produced different symptoms, but the practical response is the same: detect abnormal use of valid access before damage spreads. That aligns with NIST CSF and, where machine identities or delegated access are in play, OWASP NHI guidance. The practitioner takeaway is to unify access visibility across humans, service accounts, and integrations.

The market signal is not simply more attacks. It is that governance gaps are being monetised across every trust boundary. Attackers no longer need a single exploit class when phishing, supplier access, OAuth scope abuse, and exposed services can all lead to the same outcome. The organisations that reduce breach impact will be those that treat identity, supplier trust, and recovery as one control system, not separate programmes.

What this signals

The practical signal for readers is that identity telemetry and supplier telemetry must now be treated as one risk surface. When OAuth tokens, processor accounts, and privileged access all feed the same operational systems, a weak governance loop in any one of them can become an enterprise outage.

Access path compression: the next control maturity step is not just better detection, but fewer viable routes from trusted access to critical systems. Teams that can shorten delegated access lifetimes, narrow API scope, and remove standing privilege will make attack chaining materially harder. For a standards lens, map this to NIST SP 800-53 Rev 5 Security and Privacy Controls and identity governance practices that reduce excessive access.

For practitioners

• Harden entry paths against credential theft Prioritise phishing-resistant authentication, tighten mailbox and attachment filtering, and review where password-based login still grants access to critical systems.
• Inventory and restrict delegated API access Map every OAuth integration, service connection, and API token that can reach customer data or production workflows, then remove excessive scopes and unused connections.
• Test privileged access containment Identify where privileged credentials can still reach lateral systems, then segment those pathways and verify that break-glass access cannot spread beyond its intended scope.
• Build manual fallback procedures for critical operations For airport, manufacturing, and order-processing workloads, rehearse manual or offline operating modes so encryption or outage does not stop essential service delivery.
• Tighten third-party notification and review cycles Require faster breach notification, shorter review intervals for supplier access, and explicit offboarding for processor accounts and integration tokens.

Key takeaways

• The report shows that modern breaches often begin with trusted access rather than pure exploit chains.
• The scale matters: tens of millions of customer records, hundreds of thousands of operational records, and disrupted aviation and industrial services all stem from access governance failures.
• Teams should prioritise token scope, supplier offboarding, privileged segmentation, and recovery rehearsals because those controls limit how far a single compromise can spread.

Key terms

• OAuth Token Abuse: The misuse of valid OAuth access or refresh tokens to gain unauthorized access without repeating the original login. In NHI terms, the token becomes the credential, so the real control problem is issuance, storage, scope, and revocation rather than passwords alone.
• Access Path Compression: Access path compression is the reduction of routes by which a compromised identity or integration can reach critical assets. The goal is to limit lateral movement by shrinking the number of accounts, tokens, networks, and trusted connectors that can touch high-value systems.
• Third-Party Identity: An identity issued to a partner, vendor, contractor, or external service that can access internal systems. These identities often sit outside normal employee governance and can become persistent trust paths if they are not reviewed, expired, and revoked on schedule.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.

What's in the full article

FireCompass's full report covers the operational detail this post intentionally leaves for the source:

• Incident-by-incident technical indicators, including attacker methods, IOCs, and timeline details for each breach.
• The specific MITRE ATT&CK mappings and exploitation notes that support the weekly intelligence summary.
• FireCompass's response recommendations for attack surface testing, vulnerability discovery, and penetration-testing workflows.
• Operational context around how the reported incidents affected aviation, retail, manufacturing, and public-sector environments.

👉 FireCompass's full report includes incident details, indicators of compromise, and mitigation notes.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader security programmes they run.