Third-party data risks: Protect sensitive information across vendors, partners and supply chains

I remember the moment a CISO stepped out of a briefing to buy cigarettes. He had quit twenty years earlier. We had just spent the morning explaining what a kill chain looks like, and how a state-sponsored group works its way into a well-run organization.

When he came back, his first question was not technical: “We always patch when we need to. How is this even possible?”

That question has stayed with me for over a decade. Not because the client had done anything wrong, but because it captures something every organization eventually has to confront: doing the right things internally is necessary, but it is not sufficient.

A pattern, not an incident

I was in charge of a practice that led regional incident response and client engagement through one of the defining espionage campaigns of the last decade: the one now publicly documented as Operation Cloud Hopper, attributed to the China-linked group known as APT10. Nation-state actors used managed service providers as an entry point, riding legitimate, trusted access into the networks of the providers’ clients.

The public record on this campaign is well documented. Researchers have described a sustained, multi-year operation in which a small number of managed IT service providers were compromised, giving attackers a foothold that reached client organizations across dozens of countries and industries. What that public record cannot fully convey is what it feels like from inside the response.

I cannot name the organizations involved, but the shape of it will be familiar to anyone who lived through those years. A client was notified by law enforcement about unusual outbound traffic, months of forensic work, and the slow realization that the intrusion was neither recent nor isolated. Bringing that first environment back under full control took roughly two and a half years – not because the response was slow, but because a state-sponsored actor is built for persistence, not for a single payday.

A year later, I sat through a very different kind of meeting.

A client’s security leadership presented their governance and compliance posture, and on paper, it looked almost flawless. A colleague turned to me afterward and said there was nothing for us to do here, they had it figured out. I was not so sure. That instinct was confirmed later that same day, at a coffee machine, by a single question from that same client’s security leader: How good are your forensic and investigation skills?

We had a team on-site by Monday morning. Within days, we confirmed the same tools and patterns we had seen elsewhere. Over the five to six years that the overall response effort ran, we confirmed at least ten separate breaches across different organizations, all carrying the same signature: excellent governance on paper, coexisting with a compromised environment underneath it.

Neither client had been careless. Both had invested seriously in security. The lesson was never about negligence. It was about the limits of what even well-run internal controls can see, when the access path runs through someone else’s environment.

What changed, and what is changing again

These cases, and the public record around Cloud Hopper more broadly, are why I no longer treat third-party risk as a checkbox category. A supplier relationship is not secure just because a questionnaire says so. It is secure to the extent you can see what that supplier can reach, and how that access is used on an ongoing basis rather than once a year.