#third-party-risk
- News · Nov 5, 2026DigiCert says self-registered accounts read archived customer data, including some ID documents
DigiCert is notifying customers that an unauthorized, self-registered account read archived customer records from an internal business system between June 27 and July 2, 2026. Most were contact details; a small minority included driver's licenses, passports or utility bills. Certificates were not affected.
- News · Nov 3, 2026Chainstack says an attacker reached production through a third-party component and took password hashes
Blockchain infrastructure provider Chainstack says an attacker entered a development environment through a third-party component on October 26, reached production on October 29 and accessed customer names, emails and password hashes before being cut off on October 31.
- News · Nov 2, 2026WorkOS says an AI-assisted attack framework reached its internal sales tool and CRM data
WorkOS found unauthorized access on October 30 to an internal tool its sales and customer teams use, exposing CRM contacts, call and Slack excerpts, and directory health metadata. It saw an AI-assisted offensive framework and no access to production or application data.
- News · Oct 8, 2026ASOS breach began with an employee tricked out of their login
ASOS says an attacker impersonated a trusted contact to get an employee's login credentials, then used them to reach customer names and contact details on third-party data platforms. Snowflake says nothing on its side was at fault. The number of affected customers is undisclosed.
- News · Oct 6, 2026FBI removes contractor after a missed patch led to the ShinyHunters breach of employee data
The FBI says a contractor failed to apply a patch to a third-party-managed platform, opening the way for the ShinyHunters breach of employee records. Reuters names the platform as Oracle PeopleSoft and the firm as Accenture.