Third-party access and trusted logins: what went wrong here?

TL;DR: Two of this week's largest breaches began with valid access rather than software exploits, according to Newcore: misuse of a Danish company's lawful register access exposed about 8.8 million people, and an impersonation-led login at ASOS reached third-party customer-data platforms. The pattern shows that access legitimacy is not the same as access safety.

Editorial analysis by NHI Mgmt Group, based on content published by Newcore: “Borrowed Keys: What the Denmark CPR and ASOS Breaches Say About Trusted Access”.

Key questions

Q: What breaks when third-party access is treated like ordinary employee access?

A: The control model breaks because vendor access usually carries broader blast radius, weaker lifecycle discipline, and more indirect authentication paths than employee access.

Q: Why do impersonation attacks succeed even when passwords are strong?

A: Because the attacker is targeting the process around the password, not just the password itself.

Q: How do security teams spot malicious activity after a legitimate login?

A: They correlate identity events across applications and look for behavioural deviation.

Practitioner guidance

• Inventory every third-party identity with data reach List partner accounts, vendor accounts, and SaaS service identities that can search records, send notifications, or access customer data, and assign a named owner to each.
• Require phishing-resistant MFA for high-risk external access Use FIDO2 security keys or passkeys for any account that can reach sensitive records or customer communications, including recovery and reset paths.
• Set behavioral baselines on sensitive accounts Alert on unusual query volume, unusual message volume, new destinations, and access outside normal time windows for any account with privileged reach.

Bottom line: The central failure in both incidents was not a broken exploit chain but valid access that was never constrained by behavior.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →