Notifications
Clear all
Topic starter
06/09/2026 5:18 pm
TL;DR: An Oracle E-Business Suite zero-day, a subcontractor-account intrusion, and a ransomware-linked fintech breach created cross-organisation exposure across education, telecom, finance, and pharma, according to FireCompass’s weekly report. The pattern is clear: vendor and third-party access now drive most downstream identity and data risk.
NHIMG editorial — based on content published by FireCompass: Weekly Cybersecurity Intelligence Report Cyber Threats & Breaches 2 Dec to 10 Dec 2025
By the numbers:
- Marquis Software’s ransomware breach affected over 74 U.S. banks and credit unions.
- Inotiv’s breach affected at least 9,542 individuals after the August ransomware attack.
Questions worth separating out
Q: What breaks when third-party accounts can reach customer or ERP data directly?
A: Direct access turns supplier credentials into high-risk delegated identities, especially when those accounts can query large record sets or operate across multiple systems.
Q: Why do internet-facing application flaws often become identity risks?
A: Because web application compromise frequently exposes the components attackers need to reach identity controls, including configuration files, session tokens, admin interfaces, or service credentials.
Q: How do organisations tell whether ransomware has already become a data theft event?
A: Look for staged exports, unusual archive creation, abnormal outbound traffic, and access to repositories outside normal batch windows.
Practitioner guidance
- Classify ERP environments as high-value identity systems Map Oracle EBS, CRM, payroll, and supplier portals as sensitive identity-rich assets, then place them under emergency patching, WAF coverage, and continuous attack-surface monitoring.
- Constrain subcontractor and supplier access to the minimum record set Remove broad customer lookup rights, use role-specific entitlements, and review whether each third-party account can reach data it does not operationally need.
- Correlate application, database, and outbound traffic telemetry Join web access logs, database exports, and egress monitoring so bulk data extraction from ERP and customer platforms can be detected before extortion or fraud disclosure.
What's in the full analysis
FireCompass's full weekly report covers the operational detail this post intentionally leaves for the source:
- Incident-by-incident chronology for the Oracle E-Business Suite, Marquis, Leroy Merlin, Freedom Mobile, and Inotiv cases
- MITRE ATT&CK mappings and observable indicators tied to each breach pattern
- Victim counts, disclosure dates, and regulatory context for each reported incident
- Expanded commentary on how each breach affected different sectors and customer groups
👉 Read FireCompass's weekly cybersecurity intelligence report on the December 2 to 10 breach cluster →
Oracle EBS, subcontractor access and bank exposure: what changed?
Explore further
06/09/2026 5:19 pm
Third-party access is now a governance problem, not just a vendor-management problem. The Freedom Mobile incident shows that subcontractor credentials can function as privileged access paths when they reach identity-rich systems. That means offboarding, scope control, and behaviour monitoring matter as much as contract terms. For IAM and PAM teams, supplier identities should be treated as governed access assets, not administrative exceptions.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months. This signals that NHI governance is moving from niche concern to programme planning.
- Another finding in The State of Non-Human Identity Security shows that only 1.5 out of 10 organisations are highly confident in securing NHIs, underscoring the maturity gap behind delegated and machine access.
A question worth separating out:
Q: What should security teams require from high-concentration third-party providers?
A: They should require per-client exposure evidence, detailed telemetry sharing, segmentation between tenants, and explicit notification timelines for compromised accounts or data movement. When one provider holds records for many customers, the governance question is not only breach response. It is whether the provider can prove blast-radius containment in the first place.
👉 Read our full editorial: Third-party access and ERP compromise drove this week’s breach pattern
