Your vendor may be the weakest link: Percentage of third-party breaches doubled in a year

The percentage of confirmed data breaches involving third-party relationships doubled last year as cybercriminals increasingly exploited weak links in supply chains and partner ecosystems. That's according to Verizon's Data Breach Investigations Report (DBIR) —one of the industry's most-watched autopsies on what actually goes wrong in infosec. This year's edition, released Wednesday, covers incidents that occurred between November 1, 2023, and October 31, 2024. It found that the proportion of breaches involving third parties rose from 15 percent in last year's dataset to 30 percent in this year's report. This figure includes those breaches (incidents in which data loss was confirmed) caused by exploited software vulnerabilities and supply chain compromises. Ilia Kolochenko, CEO at ImmuniWeb and fellow at the British Computer Society, said during a launch event for the report that cybercriminals are increasingly looking at organizations such as accountants and law firms as ways to reach their intended targets. "Criminals are smart and pragmatic; they count every cent and are cost-conscious," he said, explaining why more vulnerable companies can act as reliable gateways into much bigger target environments. Verizon said that vendors and other business partners are expanding the attack surface by failing to enforce proper access controls, including preventing credential misuse. In particular, weak third-party practices continue to expose organizations to downstream risks. One ex...