Third-party breach patterns show where credential and vendor risk converge

At a glance

What this is: SecurityScorecard’s analysis links third-party breaches, MOVEit, healthcare exposures and Microsoft 365 attacks to a recurring pattern of delegated trust, stolen credentials and shared infrastructure.

Why it matters: IAM, PAM and NHI teams need to treat third-party access as a governed identity boundary, because vendor relationships can quickly become the path from initial compromise to broad operational and data loss.

By the numbers:

• 35.5% of breaches originated from third-party events, according to SecurityScorecard’s 2025 Global Third-Party Breach Report.
• The report says third-party breaches increased by 6.5% from 2023.
• Healthcare accounted for 242 total breaches, or 24.2% of all security incidents analyzed.

Context

Third-party breach analysis is really trust-boundary analysis. Once access is delegated to vendors, contractors or shared platforms, the organisation no longer controls every identity path, every credential lifecycle or every monitoring point.

That matters for IAM, PAM and NHI governance because the risk is not only external compromise. It is inherited access, reused credentials, weak offboarding and hidden downstream relationships that make a vendor incident propagate across customers and environments.

Key questions

Q: What breaks when third-party access is not governed as part of identity lifecycle management?

A: Access can outlive the business relationship that justified it, which leaves external identities active after need has ended. In healthcare, that failure can expose claims systems, patient data, and connected devices. The practical problem is not just excessive access, but access that no longer has an accountable owner.

Q: Why do third party weaknesses and stolen credentials so often turn into large scale data breaches?

A: Third party weaknesses and stolen credentials matter because attackers need only one weak entry point to reach sensitive systems and data. Once inside, they can exploit trust relationships, move through shared services, and extract valuable personal or business records. This is especially damaging when organisations assume partners or users are already secure and do not monitor data flows closely.

Q: What are the signs that vendor privileged access is being managed unsafely?

A: Common warning signs include shared vendor passwords, standing access that never expires, missing session logs, and vendors using unmanaged devices or personal email accounts. Another red flag is when offboarding depends on manual follow-up instead of enforced revocation. If a security team cannot quickly answer who accessed which system and for how long, oversight is already too weak.

Q: When should security teams prioritise vendor identity governance over additional perimeter controls?

A: When the business depends on third-party platforms that can access sensitive data or operational workflows. Adding more perimeter tooling will not close the gap if suppliers, help desks, or outsourced contact centres already sit inside the trust model. In that situation, access governance and supplier oversight deliver more value than another boundary control.

Technical breakdown

How third-party access becomes an identity trust boundary

Third-party risk often begins with legitimate access rather than intrusion. Vendors, contractors and service providers hold credentials, tokens, API keys or session-based access that sit outside the primary organisation’s direct control. If those identities are over-scoped, reused or not lifecycle-managed, an attacker can move from one compromised account into a wider environment without needing to break the perimeter. In practice, the weakness is rarely the vendor relationship itself. It is the lack of continuous governance over who can authenticate, what they can reach, and how quickly access is revoked when the relationship changes.

Practical implication: Treat every third-party identity as a governed access path with explicit ownership, scope and offboarding control.

Why credential theft scales so well across shared systems

Credential theft works especially well in environments where authentication is decoupled from context. Stolen passwords, infostealer logs and reused login data can be replayed across email, cloud and SaaS platforms, especially when non-interactive sign-ins or legacy authentication are still allowed. Once attackers have a valid identity, detection often lags because the traffic looks like normal access rather than exploit activity. Shared infrastructure then multiplies the impact, because one credential set can unlock multiple downstream systems and customer environments if trust relationships are broad enough.

Practical implication: Enforce strong authentication, retire legacy sign-in paths and monitor non-interactive access as a distinct control surface.

How supply chain compromise turns one breach into many

Supply chain incidents such as MOVEit show how a single software flaw or platform compromise can become a multi-tenant identity and data event. The initial exploit lands in one environment, but the real damage comes from the shared trust model: the software is already embedded across many organisations, and each deployment may expose its own data, integrations and downstream partners. Fourth-party exposure widens the blast radius further because vendors’ vendors inherit access or data flows that original buyers may not have mapped.

Practical implication: Inventory third-party and fourth-party dependencies, then classify which identities, data sets and services inherit risk from each shared platform.

Threat narrative

Attacker objective: The objective is to convert one compromised trust relationship into data theft, service disruption or broad downstream exposure across multiple organisations.

1. Entry occurs through third-party systems, stolen credentials or a zero-day in shared software rather than through a direct attack on the target organisation.
2. Attackers use valid access, broad vendor permissions or inherited trust to reach email, cloud, file transfer or operational systems.
3. They then expand impact by extracting data, abusing multiple customer relationships or cascading into downstream environments through shared infrastructure.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Meta Muse Spark evaluation breach 2026: A misconfigured third-party cyber evaluation pointed Meta's Muse Spark 1.1 at a real website, which it exploited and modified.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Third-party risk is now an identity governance problem, not just a vendor-management problem. The article’s core evidence shows that breach propagation depends on who can authenticate, what they can reach and how quickly their access is revoked. That pushes third-party oversight into IAM, PAM and NHI lifecycle controls rather than leaving it in procurement or questionnaire workflows. Practitioners should treat delegated trust as an access-control boundary with measurable governance.

Stolen credentials remain the most efficient bridge from third-party compromise to enterprise impact. The SecurityScorecard examples show that once attackers hold a valid identity, they can blend into normal authentication patterns and move across email, cloud and shared services. This is why standing access and legacy sign-in paths remain such a persistent problem. Teams should assume that credential replay will be the first scalable abuse path, then design controls to narrow that reuse window.

Supply chain incidents reveal a hidden blast-radius problem: organisations often know their vendors, but not their vendors’ identity reach. MOVEit and fourth-party exposure demonstrate that inherited trust can extend far beyond the original contract. Third-party identity sprawl: this is the governance gap where access, data and service dependencies multiply faster than inventory and offboarding processes. Security leaders should map where delegated identities propagate before they are forced to learn it from an incident.

Healthcare and platform-centric sectors show the same pattern for different reasons. High-value data attracts attackers, while concentrated platforms magnify the effect of compromise. The governance lesson is that breach severity is shaped by both the sensitivity of the data and the centrality of the trusted intermediary. Practitioners should prioritise the third parties that combine both attributes, because those are the relationships most likely to turn into systemic risk.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Breaches involving stolen or compromised credentials take an average of 292 days to identify and remediate, according to IBM’s Cost of a Data Breach.
• Read next: Top 10 NHI Issues

What this signals

Third-party identity governance is becoming a blast-radius control. The organisations most exposed are not necessarily the ones with the weakest internal defences, but the ones with the least visibility into where vendor identities can authenticate and what those identities can reach. That makes access inventory, authentication policy and revocation timing the primary levers for reducing systemic exposure.

Credential replay across shared services is now a repeatable attack pattern. Security teams should expect stolen credentials from one breach to be reused against cloud, email and SaaS environments until authentication paths are tightened and anomalous sign-ins are actively hunted. Practitioners who do not separate third-party access telemetry from internal user telemetry will miss the earliest signals.

For practitioners

• Map delegated access paths across vendors Inventory every third party that can authenticate to your environment, then record the identities, privileges, data scopes and offboarding owners attached to each one.
• Remove legacy authentication from third-party access Block non-interactive or weak authentication flows where vendors still rely on them, and treat those paths as high-risk until they are retired.
• Tie third-party offboarding to credential revocation Make contract termination, role change and inactivity trigger immediate removal of tokens, secrets, VPN access and federated sessions.
• Classify vendors by blast radius, not just spend Prioritise third parties that hold sensitive data, central platforms or broad downstream access, because those relationships turn a compromise into a systemic event.
• Monitor for credential replay across shared services Correlate sign-in anomalies, password-spraying signals and repeated logins from known infostealer or botnet infrastructure across email and cloud services.

Key takeaways

• Third-party breaches are not just vendor incidents. They are identity governance failures when delegated access, reused credentials and inherited trust are not tightly controlled.
• The article’s evidence shows that shared platforms and stolen credentials create the fastest path from one compromise to many downstream victims.
• Teams that want to reduce this risk should map third-party access, remove weak authentication paths and enforce immediate revocation when relationships change.

Key terms

• Third-party identity governance: Third-party identity governance is the control of how external people and organizations are granted, reviewed, monitored, and removed from access. It covers contractors, suppliers, partners, and other non-employees, using identity lifecycle controls, least privilege, periodic recertification, and evidence of accountability to reduce unauthorized access and compliance risk.
• Credential replay: Credential replay is the reuse of stolen authentication material to impersonate a legitimate user or system. In human identity programmes, replay risk grows when passwords, OTPs, or weak recovery flows can be captured and used from a separate device or session.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Fourth-party risk: Fourth-party risk is the exposure created by a vendor’s own vendors, sub-processors, and downstream service dependencies. It matters because direct contractual control usually stops at the first tier, while operational and data-risk propagation often continues much further through the chain.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management and workload identity. It helps security practitioners connect third-party access risk to identity lifecycle control across their wider programmes.