Blog

Third-party data breaches can happen at any time to any organization. This type of breach occurs when a vendor (or some other business partner) holding your company’s data suffers a breach, and your data is exposed. According to the Verizon 2022 Data Breach Investigations Report, 62 percent of all data breaches happen via third-party vendors.

Even worse, IBM and the Ponemon Institute report that on average, a company takes 277 days to identify and contain a third-party data breach. Why so long? One reason is that threat actors have become much better at operating in stealth mode once they enter the computer system. Another, more troubling explanation is that some third-party contractors and vendors may attempt to hide a data breach from clients to avoid damaging the partnership. 

Regardless, the consequences and cost of recovering from a breach can be detrimental to your business and bottom line. The average cost of a data breach in the United States has been pegged at $9.48 million for 2023. Big targets include healthcare organizations, credit card companies, email service providers, and cloud service providers. 

This post will cover examples of common third-party breaches, as well as what to do when a third-party data breach strikes your organization.

Examples of Third-Party Security Breaches

Third-party suppliers, partners, and vendors are prime targets for cybercriminals. Here are a few instances of third-party violations from recent history:

• Customers of Click Studios’ business password manager Passwordstate received a breach notification in 2021 after hackers used the app’s update mechanism to spread malware to users. It was unclear how many of the nearly 370,000 security and IT professionals who use Passwordstate at 29,000 organizations worldwide had been impacted by the incident. Click Studios instructed victimized customers to change every password in the Passwordstate database.
• Toyota, a leading global auto manufacturing company, experienced a third-party data breach in 2022. As a result, the company had to close its manufacturing plant in Japan temporarily to safeguard its data. Additionally, the breach had implications on the operations of other Toyota subsidiaries.
• The Cancer Centers of Southwest Oklahoma’s third-party cloud storage provider, Elekta, identified odd behavior on its network in 2021. It found that 8,000 cancer patients’ sensitive health information was accessed without authorization. As a result, names, Social Security numbers, locations, birthdates, and information about medical diagnoses and treatments were disclosed.
• The Saudi Arabian oil company Saudi Aramco had 1 terabyte of data stolen, which included details about its employees, customers, sites, reports, and project papers. The cybercriminals gave Aramco an ultimatum: pay $50 million to have the data deleted, otherwise it would be offered for sale on the dark web for $5 million. Saudi Aramco claims that a flaw at a third party caused the intrusion.

Common Data Breaches Caused by Third-Party Vendors

Phishing and ransomware attacks have been spiking, especially during the COVID-19 pandemic, when the number of employees working from home soared. Phishing and ransomware are standard cybercrime tools that may lead to the following types of data breaches:

• Unauthorized access via a company email account. General Electric experienced a breach that exposed employees’ personal data such as marriage certificates, passports, driver’s licenses, and tax withholding forms.
• Hacking of a telecommunications provider. Sensitive information of more than 50 million T-Mobile customers was exposed when an unprotected router was accessed.
• Lack of encryption. A vendor for Health Share of Oregon, which coordinates care for Medicaid patients, had an unencrypted laptop stolen, exposing the personal information of more than 650,000 people.
• Unsecure websites and improperly stored log-in information. A website bug allowed access to thousands of passwords and usernames for an Instagram account via the third-party Social Captain.

These breaches are bad enough on their own. Even worse, the sensitive information stolen by cybercriminals was already available for sale on the dark web when they were discovered. From there, even more scams are perpetrated on unsuspecting customers and clients whose phone numbers and addresses have been exposed.

Preventing Third-Party Vendor Data Breaches and Holding Vendors Accountable

Holding third-party vendors accountable can be difficult, especially if you don’t have a third-party security policy or program. Ideally, any third-party vendor should enforce the same strict standards and internal data security controls that your company follows.

So how do organizations best prevent third-party vendor data breaches? It begins with a robust and responsive vendor risk management policy, which can be divided into several action areas.

Consider information security during vendor selection

When selecting a vendor, you must consider how those vendors handle information security. Talk with your vendors early about their security processes; understand how they handle internal security along with your company’s. Only sign contracts with those vendors whose internal security processes align with your own security objectives. 

Audit third-party vendors for compliance

An audit is the only way to see what’s really happening with your vendor’s security, so perform those audits whenever necessary (say, with particularly high-risk data you’re entrusting to a vendor). An audit evaluates how the organization executes against its security compliance framework, as well as its performance in previous audits. Look for indicators of compromise and how well the vendor assesses cybersecurity risk.

Require proof of the third-party vendor’s cybersecurity program

Proving the third-party vendor has an information security program is only half the battle over third-party breaches. The third-party vendor should be able to demonstrate that it takes risk management seriously and dedicates resources to its vulnerability management program.

Ask for the most recent results from internal risk assessments, penetration testing, and compliance frameworks. The third-party organization must have a robust risk management program, a supply chain risk mitigation strategy, and plans to remediate a potential data breach.

Ongoing third-party risk monitoring gives you continuous insights into the vendor’s cybersecurity program. Hold quarterly reviews to evaluate your vendor’s performance metrics and security posture.

Set clear policies and expectations for data storage and transfer

Collaboration with third-party vendors often involves sharing or transferring data. Data storage and transfer without a defined policy can expose companies to risks, including unauthorized access, data breaches, and failure to comply with data protection regulations. 

By establishing clear guidelines, companies can set boundaries and expectations regarding data storage and transfer. This assures that third-party vendors treat organizational data with the same importance and standards as their data. Defined data storage and transfer policies act as a protective layer, ensuring data integrity at all levels.

Adopt a least-privileged model for data access

Many third-party data breaches have one thing in common: the third party was given more access than necessary to complete its job. Holding third-party service providers to strict least-privileged access management standards will improve your network security significantly.

Least-privileged access is the cornerstone of managing vendor risk. A breach will only do minor damage when the third-party vendor’s access is restricted to the lowest possible access level.

Continuous monitoring for third-party vendors

Third-party vendors play an integral role in your organizational supply chain. They can also introduce multiple risks, including data breaches and compliance violations when not properly monitored. That means evaluating vendors only at the beginning of the business relationship is not enough; you need to monitor your vendors on an ongoing basis. 

Continuous monitoring assures that the organization remains informed of any changes in the risk profile of its third-party vendors. It also allows you to take new measures and adapt your compliance strategies accordingly. With ongoing monitoring, organizations can detect potential threats earlier and foster a culture of transparency and accountability with their vendors. That, in turn, strengthens the trust and reliability in the partnership, assuring both parties are aligned in maintaining the highest standards of security and compliance.

Measure fourth-party risk

In addition to third-party vendors, some organizations may also face fourth-party risk — that is, the risk from your vendors’ vendors. Many organizations overlook fourth-party risk essential, but assessing it is critical. Fourth-party relationships include any additional vendors, suppliers, and partners that your third-party vendors depend on. It covers the additional risks businesses are exposed to outside of those initial third-party partnerships. 

Organizations often have visibility into their third-party vendors, but not into entities further down the supply chain. To manage this effectively, companies should require transparency from their third-party vendors about the vendors’ own supply chains.

What Do You Do if You Have a Third-Party Data Breach?

Let’s say you just became aware of a data breach at your company. What to do next depends on whether hackers stole information or the information was unintentionally published on the company’s website.

What actions must be taken, and who needs to be contacted if personal information has been exposed?

Secure your operations

Immediately patch any vulnerabilities in your own systems that may have contributed to the incident. Data breaches quickly become worse when there are several of them. Do everything possible to prevent it from happening again.

Secure any locations connected to the incident. If necessary, lock them and change the access codes. Then ask law enforcement and forensics professionals whether it is OK to restart normal activities.

Immediately mobilize the breach response team to stop further data loss. The specific actions to take may vary depending on the type of breach and how your company is set up.

Take down information

Quickly remove any personal information from your website affected by the data breach. Be aware that search engines “cache” or retain information for a while. Get in touch with them to ensure they do not archive personal information that was exposed.

Search for the disclosed data online to check if other websites have saved a copy. If you find something, contact those websites and urge them to take it down.

Interview the individuals who found the breach. Also, talk to anyone else who might be familiar with it. Finally, tell customer care center employees where to send information about the incident.

Alert necessary parties

Notify law enforcement, police, other impacted organizations, and affected individuals if the company has a data breach.

Find out what the company’s legal requirements are. All 50 states, the District of Columbia, Puerto Rico, and the Virgin Islands have laws mandating notice of security breaches involving personal information. Other countries have their own laws too.

Figuring out what to do in the heat of the moment can be overwhelming. Therefore, incident response plans are critical. Comprehensive response plans outline the roles, responsibilities, and activities that need to happen if there is a data leak or security breach.

Overcoming Resistance from Your Third-Party Vendor

Sometimes your third-party vendor may be reluctant to follow best practices, but that vendor is the only choice for the service you need. If that’s the case, vendor risk management comes down to how much risk your organization is willing to accept, and what cybersecurity measures you have in place to prevent the inadequate security of a third-party vendor from hurting your business.

You can convince your vendors about the importance of security standards through education. A third-party vendor may welcome a well-developed risk management plan in addition to security basics such as protecting against malware, ransomware, and phishing. Share information security training webinars and other materials to grow their interest.

No matter how you broach the topic, think “security first” when pursuing a third-party vendor relationship. It will ultimately lead to fewer third-party data breaches.

Improve Your Cybersecurity with ZenGRC

Cybercriminals will continue to attack and exploit businesses and consumers alike. It is important to keep track of the new cyberattacks and risks that pop up daily. ZenGRC is an intuitive, easy-to-use platform that monitors new compliance issues and regulations while you focus on your business.

Managing third-party providers and the risk they bring to your company can be challenging. A third-party risk management program like ZenGRC can streamline the onboarding and vendor risk assessment processes. Additionally, it uses inherent risk analysis to evaluate appropriate supplier controls and conduct supplier due diligence.

Managing third-party risk is essential regardless of the size of your business or the sector you are in. Take action before it’s too late and adopt a risk and compliance system that scales as your business grows, automatically analyzes risks, and identifies potential hazards.

Schedule a demo today and get the advantage of ZenGRC.

As global data privacy and cybersecurity regulations continue to proliferate, the pressure for organizations to manage compliance risk grows. And the first step in your journey to better compliance risk management is the compliance risk assessment.

In this article we will explain what a compliance risk assessment is, how you undertake one, and how to implement your risk assessment’s findings after the assessment is complete.

What Is Inherent Risk?

To begin, an organization should determine the amount of inherent risk it faces. Inherent risk is the potential harm when a risk is left untreated or ignored. Use a disciplined, objective method to analyze each risk’s likelihood and possible effect to help you understand the inherent risk you face. This also implies that the less a company tries to manage risk, the more risk it inherently has.

Understanding inherent risk allows a company to develop an early sense of the risk mitigation that might be necessary. When identifying inherent risk, companies should analyze the critical risk characteristics, which may be divided into four categories:

Legal Impact

Legal or regulatory proceedings against the company or its workers may result in fines, penalties, incarceration, product confiscation, or debarment. Any time a company or its employees violate the law or compliance requirements, they are subject to legal issues.

Financial Impact

Financial impacts are the harm caused to the organization’s income statement, share price, or possible future earnings. A financial impact can be caused by various compliance issues, including fines from legal issues, lost sales from reputational damage, or reduced cash flow from factory downtime.

Business Impact

Internal or external factors can impact a company’s day-to-day business operations. A failed new product can slow business growth, and political sanctions can disrupt the supply chain.

Reputational Impact

The organization’s reputation or brand can be damaged by negative media coverage (in traditional news media or social media). Bad press can result in loss of customer trust and lower employee morale.

Measure each of these impacts in qualitative and quantitative terms for a comprehensive view of risk. Qualitative research often uses a low-medium-high scale to express the magnitude of a risk. Since it is a more subjective measurement, creating definitions for each level of magnitude is crucial.

Quantitative assessments are numerical estimates of potential harm. For example, if you know your factory ships $1 million daily, you can calculate the impact for each day of downtime. Precision is preferred, but estimates are better than nothing.

What Is a Compliance Risk Assessment?

A compliance risk assessment analyzes how an organization might not meet its regulatory compliance obligations. This should be a holistic analysis to identify all the compliance requirements that various laws, rules, and industry standards might impose on your organization and how well your existing compliance program does or doesn’t meet those expectations.

Common Compliance Risks

Smart business leadership not only recognizes these risks; it also effectively addresses them. Below are four prominent compliance risks that modern enterprises face all the time:

1. Data privacy infringement

The European Union’s General Data Protection Regulation (GDPR) revolutionized data privacy rules forever, giving consumers more control over their data. This regulation mandates data portability, breach notifications, child data protection, and more, all designed to empower the consumer. Non-compliance leads to hefty fines, making strict adherence necessary.

2. Protected Health Information (PHI) mishandling

For organizations handling medical data, complying with the Health Insurance Portability and Accountability Act (HIPAA) is crucial. Neglecting proper risk assessment and procedures can expose sensitive patient data. Compliance measures include securing electronic patient records and implementing rigorous protocols to prevent data mishandling.

3. Lack of disaster preparedness

Natural or human-induced disasters pose significant threats to IT systems. Business continuity maintains daily operations during crises, while disaster recovery restores IT systems efficiently. Compliance with standards such as ISO 27031, SOC 2, NIST, and HIPAA demands a robust disaster recovery plan that focuses on vulnerability identification, minimized disruption, team coordination, and regular drills.

4. Breach of payment card data

Backed by major card brands, the Payment Card Industry Data Security Standard (PCI DSS) guards against hackers targeting payment card data. Qualified Security Assessors (QSAs) certified by the PCI Security Standards Council play a pivotal role in safeguarding customer data.

What Does Compliance Risk Involve?

Compliance risk is the organization’s exposure to the potential consequences of non-compliance. That is, if the business doesn’t meet its compliance obligations, what fines, penalties, or other costs might regulators impose?

Monetary fines can be hefty. Other possible penalties include loss of operating licenses or disbarment from government contracts. Corrective actions can be expensive to implement. There would also be legal costs as regulators investigate, plus the potential for civil lawsuits and reputational loss among your customers.

Many regulators will offer more favorable treatment to a company that can demonstrate it has a compliance program in place and is at least trying to meet its obligations.

A compliance risk assessment measures the gap between what your compliance program does versus what your compliance program should do to pass muster as an “effective” program in the eyes of regulators. Mitigation is the steps you take to reduce your compliance risk until it achieves that effectiveness goal.

Before an organization can mitigate its compliance risk, however, it must conduct a compliance risk assessment.

Compliance Risk Assessment Steps

A comprehensive risk assessment will include several steps:

1. Identifying risks
2. Analyzing the level of the risk
3. Determining what actions might be necessary to decrease the risk
4. Implementing initiatives
5. Evaluating the effectiveness 

Here are each of the steps in more detail.

Step 1: Identifying Risks

Identify which regulatory compliance standards apply to your business, then document key workflows, information systems, and transactions. These efforts will require input from stakeholders of every business unit. Take note of areas in essential functions and procedures that suggest non-compliance with regulatory requirements.

Here’s how to identify compliance risks:

1. Research regulations. Understand the laws and standards applicable to your industry.
2. Internal audits. Evaluate your practices against compliance requirements through internal audits.
3. Employee input. Encourage employees to report practices that could raise compliance concerns.
4. Third-party evaluation. Assess compliance of vendors and partners.
5. Analyze history. Study past incidents for patterns and recurring issues.
6. Tech and data check. Review IT systems and data management gaps in compliance.
7. Training review. Gauge the effectiveness of compliance training programs.
8. Stay updated. Monitor evolving compliance regulations and industry trends.
9. Benchmarking. Compare your practices with industry peers for insights.
10. Consult experts. Seek guidance from legal or compliance professionals.

Step 2: Map Potential Risks to Possible Outcomes and Affected Parties

Once you’ve evaluated the company’s operations and where compliance gaps or risks may be, map those risks to their potential outcomes and affected parties. Not only is this critical documentation to have for auditing purposes, but it’s also a way to begin your risk mitigation strategies.

Step 3: Prioritize the Most Severe Risks and Determine Control Measures

Implementing new compliance programs (or improving the existing program) can be overwhelming. We recommend prioritizing all the identified risks by the potential severity of their outcomes and addressing the most severe first.

Ask: Where are existing controls failing to address those risks? How can you remedy that? Also, consider how you can detect a violation of the rules for these severe risks in the future. This will reduce any non-compliance surprises.

Step 4: Implement Controls and Validate through Testing.

Once you’ve determined what must be done to mitigate compliance risks, implement those steps — but you’re not done there! Testing to validate controls is an essential next step before proceeding to another risk. Review the results and decide whether the control works as desired. If not, investigate why, and if necessary, implement more or better controls to get the desired performance.

Step 5: Routinely Re-Evaluate Risks, Test Controls, and Update as Needed

Remember that a corporate compliance program should be an ongoing part of business. As the business grows, risks will change. Legislation affecting the business also evolves. Moreover, unmonitored, unenforced controls tend to lapse after a while. So you should routinely monitor controls, re-test them periodically, and re-evaluate them as the business grows and laws change.

Compliance Risk Assessment Frameworks

The Committee of Sponsoring Organizations (COSO) framework for internal control is the most widely accepted framework for building internal control systems. For senior management and boards of directors, the COSO framework provides:

• Guidance to create and apply internal controls for any business, regardless of industry, at every level of the company.
• A principled approach for the organization to drive its internal controls’ design, implementation, and execution.
• Requirements to help assure internal controls, components, and principles function and operate together.
• A way to identify and evaluate risks and to develop the appropriate mitigation strategies: ones maintain an acceptable level of risk with a focus on fraud prevention.
• Expanded control application beyond financial reporting to operational and compliance objectives.
• The ability to eliminate inefficiencies and redundancies in controls while maximizing value in risk reduction.

How Does Compliance Risk Assessment Differ From Other Risk Assessments?

Risk assessments exist for various business risks and industries, including financial services, government contracts, and healthcare.

Compliance risk assessments identify, prioritize, and control risks associated with the threat of non-compliance in your industry. Potential penalties could be fines, reputation damage, legal repercussions, or the inability to operate the business.

Unlike other forms of risk assessments, compliance risk assessments focus on the legal or regulatory requirements that an organization must comply with. Furthermore, risk analysis and compliance testing are typically managed by your compliance department’s chief compliance officer.

The chief financial officer, the chief information officer, or another C-level executive might manage other risks.

How RiskOptics Can Support Compliance Risk Assessment

Evaluating risks, implementing the appropriate controls, and gathering documentation every step can be time-consuming and prone to error if you rely on manual processes and tools such as spreadsheets.

The ROAR Platform is a governance, risk management, and compliance software tool that simplifies compliance efforts through automation of tedious, manual tasks. Its easy-to-use risk management templates provide an outline to evaluate risk properly, while our user-friendly dashboard metrics show you where you’re doing well and where your gaps are in real time, so you always know where you stand.

ROAR also tracks compliance training and documentation requirements across laws and regulations such as the EU General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), Health Insurance Portability and Accountability Act (HIPAA), and more.

Schedule a demo today to learn how the ROAR Platform streamlines compliance risk management.