Topic starter
06/09/2026 6:21 pm
TL;DR: Late September 2025 saw a concentrated breach pattern across aviation, retail, manufacturing, and local government, with spear-phishing, compromised OAuth tokens, third-party access, and exploited vulnerabilities driving outages and data theft, according to FireCompass. The pattern shows that identity controls, supplier governance, and detection speed now shape incident blast radius more than perimeter defenses.
Editorial analysis by NHI Mgmt Group, based on content published by FireCompass: “Weekly Cybersecurity Intelligence Report Cyber Threats & Breaches 23 Sep – 29 Sep, 2025”.
Key questions
Q: What breaks when third-party access is not reviewed continuously?
A: The break is that access stays active long after the business relationship, vendor task, or application purpose has changed.
Q: Why does mishandled OAuth token storage create such high compromise risk?
A: Mishandled tokens create risk because OAuth shifts trust to the SaaS provider handling the token, not just the identity provider.
Q: What do security teams get wrong about supplier access?
A: Teams often assume supplier access is temporary or low risk, then fail to review it with the same discipline as internal access.
Practitioner guidance
- Tighten OAuth token governance Limit token scope to the minimum API actions required, shorten lifetime where possible and maintain rapid revocation procedures for compromised sessions.
- Review third-party identity access Inventory supplier accounts, integration users and delegated application grants that can reach customer or production systems, then assign explicit owners and expiry dates.
- Correlate identity and API telemetry Watch for unusual API access patterns, off-hours exports, new geo-locations and repeated consent grants that suggest token abuse or delegated access misuse.
Bottom line: This breach wave was less about one exploit than about multiple trust paths failing at once, from delegated SaaS access to supplier connectivity and OT exposure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 6:22 pm
Third-party access is now part of the identity perimeter: When suppliers, integrations and delegated applications can reach production data, the attack surface extends beyond employee IAM. This article shows that breach containment depends on tracking external identities, not only internal users. Practitioners should govern supplier access with the same lifecycle discipline they apply to privileged human accounts.
A question worth separating out:
Q: Should organisations prioritise token revocation or endpoint hardening first?
A: If the report’s patterns are your concern, token revocation should come first where SaaS persistence or secret theft is active, because those paths preserve attacker access immediately. Endpoint hardening still matters, but it will not contain a live OAuth compromise or a reused developer secret. The right sequence depends on where trust is already exposed.
👉 Read our full editorial: Supply chain, OAuth and OT failures defined the late September breach wave