Third-Party Human Risk: When the Breach Starts at a Vendor

In 2013, attackers who wanted 40 million payment cards from Target didn't start at Target. They started at Fazio Mechanical Services, a Pennsylvania heating and refrigeration contractor, with a malware-laced phishing email that stole the credentials Fazio used to log in to Target's vendor portal. One employee at a company most Target customers had never heard of clicked, and one of the defining retail breaches of the decade followed.

A decade later, that pattern is no longer the memorable exception — it's the growth area. The Verizon 2026 Data Breach Investigations Report found that 48% of breaches now involve a third party, with supply-chain-linked breaches up 60% year over year. Combine that with the human element still present in 62% of breaches, and the conclusion is uncomfortable but unavoidable: your risk surface includes people you've never met, never trained, and never tested. This guide is about managing exactly that.

Why attackers route through your vendors

Attackers follow economics, and the vendor route pays twice.

First, it inherits trust. A login from your IT provider's account, an invoice in a thread you were already having with a supplier, a call "from your MSP" — all arrive pre-authenticated in the psychological sense. The scrutiny your staff applies to a stranger simply isn't applied to a known counterparty, and technical controls often mirror that bias: vendor accounts and integrations frequently bypass the conditional-access rules and monitoring applied to employees.

Second, it scales. Compromise one company and you've breached one company; compromise one service provider and you've bought a key that opens every customer door. When attackers breached Okta's support case management system in October 2023 using stolen credentials, the files they took — support uploads containing session tokens — were immediately usable against Okta's customers, and companies like BeyondTrust and Cloudflare found themselves defending against attacks that began in someone else's back office. Okta's own root-cause analysis traced the intrusion to something profoundly human: an employee had signed in to a personal Google account on a company laptop, and a service-account credential saved there was exposed when that personal account was compromised.

Your security awareness program covers everyone on your payroll. Your attack surface includes everyone on your vendors' payrolls too.

Four ways a vendor's people become your incident

1. The hijacked supplier mailbox. In vendor email compromise, the attacker takes over a real supplier's email account, reads quietly, then redirects a genuine payment from inside a genuine thread. Because sender, history, amount, and timing are all legitimate, standard phishing tells are absent. The FBI puts cumulative exposed losses for the wider BEC category at $55 billion over a decade — and the vendor-compromise variant produces some of its largest single losses.

2. The vendor that never existed. Sometimes the attacker doesn't compromise your supplier — they become one. Evaldas Rimasauskas registered a company with the same name as Quanta Computer, a real Taiwanese hardware maker, and invoiced Google and Facebook for equipment they genuinely bought — from the real Quanta. The two most technically sophisticated companies on Earth wired him over $120 million before anyone checked the bank account behind the invoice.

3. The outsourced help desk. When you outsource IT support, you outsource the single most socially engineered function in your company. Clorox learned this in August 2023, when attackers linked to Scattered Spider phoned the service desk run by its provider Cognizant and simply asked for password and MFA resets. Clorox's $380 million lawsuit quotes the transcripts: "At no point during any of the calls did the Agent verify that the caller was in fact Employee 1." The agent wasn't a Clorox employee. The consequences were entirely Clorox's.

4. The stolen vendor credential. Target's contractor was phished; Okta's engineer synced a service account into a personal browser profile, where credential-harvesting infrastructure could reach it. However the theft happens — phishing pages, password reuse, an infostealer on an unmanaged device — the result is the same: an attacker holding legitimate remote access that your monitoring was built to trust.

Incident	Year	The human failure — at the third party	Consequence
Target / Fazio Mechanical	2013	Contractor employee opened a malware phishing email	40M payment cards stolen via vendor portal access
Google & Facebook / fake "Quanta"	2013–2015	AP teams paid forged invoices from a lookalike supplier	$120M+ wired to a fraudster
Okta support system	2023	Service-account credential saved in a personal Google profile	Customer session tokens stolen; downstream attacks on Cloudflare, BeyondTrust
Clorox / Cognizant	2023	Outsourced help desk reset credentials without verifying callers	~$380M claimed damages; operations disrupted for months

What regulators now expect

Supply chain security has moved from best practice to legal obligation. In the EU, NIS2 Article 21(2)(d) makes "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" a minimum risk-management measure for essential and important entities — sitting alongside the cyber hygiene and training requirements in the same article. For financial entities, DORA layers on a dedicated ICT third-party risk-management regime. Our NIS2 human risk guide covers the training and governance side in detail; the point here is that "our vendor got phished" is no longer a defense. Regulators treat your suppliers' weaknesses as your risk to manage.

How to manage human risk you don't employ

You can't train another company's staff. You can do these six things.

1. Map who can actually hurt you. Skip the 400-row vendor spreadsheet ranked by contract value. Rank by access and money: who holds credentials, VPN tunnels, or API keys into your environment; who can change where your payments go; who holds your data. A janitorial contractor with badge access and an HVAC firm with network access (ask Target) both belong higher on the list than a seven-figure supplier with no connectivity.

2. Put human-layer controls in the contract. Security questionnaires ask about firewalls and certifications; almost none ask what happens when an attacker calls. Require, in writing: continuous security awareness training with phishing simulations (with evidence, not attestations), phishing-resistant MFA on every account touching your systems, documented identity verification before any credential or MFA reset, and breach notification within a defined clock — hours, not "promptly."

3. Make payment changes vendor-proof. Assume every bank-detail change request is hostile until verified by a call to a number from your master vendor file — never one from the email or invoice. Make the callback mandatory and exception-free, and pair it for new suppliers with independent verification that the company and account exist. This one procedure neutralizes both hijacked-mailbox and fake-vendor fraud.

4. Treat vendor accounts as your riskiest identities. Least privilege, time-boxed access, no standing admin rights, MFA enforced by you rather than delegated, and alerting on vendor logins from new locations or at odd hours. When a vendor's credential is stolen, the question is whether your environment notices — theirs won't.

5. Rehearse the vendor scenario. Your incident response plan probably assumes the compromised account belongs to you. Run a tabletop exercise where it doesn't: the attacker is inside your MSP, the fraudulent invoice was paid three weeks ago, the vendor's lawyers are slower than your regulator's deadlines. Teams discover in an afternoon which contacts, contracts, and containment options they're missing.

6. Measure the risk like you measure your own. If you quantify employee risk with a Human Risk Score, extend the logic outward: score vendors on access level, financial authority, verified training and simulation practice, and incident history. A vendor tier with no data is a score — the worst one.

You are someone's third party

One closing mirror: every argument above runs in reverse. To your customers, you are the vendor whose phished employee becomes their breach — and as Okta's October 2023 disclosure showed, a service provider's handling of one compromised credential can define its reputation for years. The organizations that will win enterprise deals in the NIS2 era are those that can answer a customer's human-risk questionnaire with data: training coverage, simulation results, help-desk verification procedures, measured and current. Managing human risk was always about protecting your own environment. Increasingly, it's also what your revenue depends on.