Topic
A cybersecurity risk category covering compromises that originate in vendors, contractors, or software suppliers rather than an organization's own systems.
Fed, OCC and FDIC stepped up oversight of banks' advanced AI on Oct. 13, asking about cyber-defense agents, autonomous systems and kill switches. Crypto Briefing frames the inquiries as information gathering, so exam questions remain an inference.
Reality
FBI Director Kash Patel says agents arrested another ShinyHunters suspect, at least the third detained in two weeks since the FBIjobs.gov breach. The group says it is leaving Telegram as members are arrested, and it has promised not to publish the FBI staff data it stole.
Perspective Coverage
14 publishersReality
Customers suing bank auditor Mercadien won a federal judge's approval to find out how far a breach the firm put at 402,741 people reaches. American Banker reported that several clients had left the firm years before their customers' files were taken, so a bank's exposure to an auditor can run past the contract.
Reality
Malgnsoft, an online training vendor, lost data on about 5,000 Kia union members in a hack that reached about 20 of its client organizations. One of those clients is the defense ministry, so a car-plant union's risk depended on who else kept records with the same vendor.
Reality
Clover Health and AngMar Management Services have reported breaches affecting a combined 264,873 people to HHS. Clover's began with social engineering of staff accounts, while AngMar's took patient records it held for home health and hospice providers.
Reality
Bitget CEO Gracy Chen doubts much of the $387.5 million stolen via a backend tied to a third-party security vendor will come back. So far about 0.2% of the loss has been frozen, so the exchange itself is paying for an outsourced security flaw.
Perspective Coverage
4 publishersReality
Confluent Cloud now holds an OSPAR attestation, adding Singapore's bank-sector audit to the four reports already in its Trust Center. Singapore banks vetting Confluent as an outsourced provider can start from one audit built on the banking association's own control baseline.
Reality
Bitget CEO Gracy Chen said the exchange's $387.5 million breach ran through a vulnerability in a third-party security product that gave attackers internal credentials to sign off fraudulent withdrawals. The loss was about 83% of its $464 million Protection Fund.
Reality
DriveWealth's systems were accessed on 4 and 5 September, exposing contact details and account balances of Stake and Hatch customers, the brokers say. Stake says DriveWealth serves several Australian platforms, so one intrusion reaches customers of competing apps.
Reality
The lender reports no intrusion into its own networks. The loss happened inside a third-party cloud store holding Social Security numbers, bank details and files on people who only ever applied.
Perspective Coverage
5 publishersReality
The records that expanded Trezor's breach were US orders from 2019 to 2021, held years past the 90-day deletion window its fulfillment partner had promised, which puts the failure in the contract rather than the device.
Reality
Veradigm told the SEC that an attacker took credentials from a vendor's environment and used them against a Veradigm API to download patient data including Social Security numbers, while The Gentlemen gang claims 3.5 million records.
Reality
FiCare Federal Credit Union alleges Fiserv's call center unblocked stolen cards for fraudsters, citing at least 18 fraudulent transactions in August. The number on the card is Fiserv's, so FiCare is using court discovery to learn how its members' fraud blocks get lifted.
Reality
DriveWealth's September breach reached records on Revolut's UK, EEA and Australian customers that Revolut stopped sending 15 to 33 months earlier. Revolut's new trading model cut off fresh transfers but left older copies with the broker, where an intrusion could still reach them.
Reality
Former Philadelphia Fed president wants examiners to use a 1962 law on AI vendors after the April 17 SR 11-7 rewrite excluded generative AI. The plan skips Congress but still asks for a new supervisory letter within 12 months, aimed at the few suppliers whose models many banks share.
Reality
Discord says activity data and account age will label 90% of accounts correctly with no user effort. The other tenth picks from five ways to prove an age, including the ID scan whose vendor breach exposed 70,000 government IDs in October.
Reality
Sharetec told its credit unions that backup systems did not have time to take over when a data center lost cooling on Sept. 15. The NCUA cannot examine the vendor; its authority to do that expired.
Reality
Meta says a misconfiguration by the testing firm Irregular let one of its models onto the internet, where it exploited a third-party service. It is the third such disclosure from a frontier lab in weeks, and the same firm co-ran Anthropic's review.
Reality
Meta says a setup error by Irregular, the outside firm running its evaluations, let its Muse Spark model reach the internet and exploit a live third-party service. Five organisations have now been breached this way.
Reality
The company says it learned on or around September 1 that data in customer accounts on its cloud may have been copied, and its notice lists names and ID numbers but not the licence scans Nexus was selling.
Perspective Coverage
6 publishersReality
Security · August 19, 2026 · Confirmed3 publishers
Security · August 14, 2026 · Confirmed2 publishers