Third-party breach cascades: what changed for supply chain risk?

TL;DR: 136 verified third-party breach events in 2025 touched 719 publicly named victim companies, with 27 incidents affecting roughly 26,000 more organisations only in aggregate, according to Black Kite, showing that supply chain blast radius now outpaces disclosure and naming. The control problem is not just upstream compromise but delayed visibility into where delegated access and shared platforms propagate harm.

Editorial analysis by NHI Mgmt Group, based on content published by Black Kite: “2025 Incidents”.

By the numbers:

• 136 verified third-party breach events were publicly disclosed in 2025, breaking the previous pattern of more stable yearly volumes.
• 719 publicly impacted companies were named across those incidents, which captures only the disclosed portion of the downstream blast radius.
• 27 separate incidents disclosed downstream impact only in aggregate, hiding approximately 26,000 additional affected companies.

Key questions

Q: What breaks when third-party access is not reviewed continuously?

A: The break is that access stays active long after the business relationship, vendor task, or application purpose has changed.

Q: Why does disclosure delay make supply chain breaches worse?

A: Disclosure delay extends the period in which stolen or misused credentials remain active.

Q: How should security teams reduce the blast radius of edge compromise?

A: Treat internet-facing gateways as entry points into identity risk, not isolated infrastructure assets.

Practitioner guidance

• Map all delegated vendor access paths Inventory OAuth grants, API keys, service accounts, and connected apps that allow vendors or SaaS tools to act inside your environment, then rank them by blast radius and business criticality.
• Pre-stage emergency revocation for third-party credentials Define who can disable tokens, connected apps, and service accounts when a supplier is suspected of compromise, and make that authority available before vendor confirmation arrives.
• Treat disclosure lag as a control gap Assume a vendor may know about an incident long before customers are notified, and test whether your monitoring can detect misuse of shared integrations during that window.

Bottom line: Third-party breaches are increasingly measured by how far they propagate, not just by how many vendors are named.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →