Nearly ever major financial institution across Europe has been impacted by third-party and fourth-party cyber breaches in the past year, according to research from SecurityScorecard.

The firm’s analysis of Europe’s top 100 financial firms by assets under management (AUM) over the past 12 months highlights a troubling 25% spike in third-party breaches in the last year, placing a spotlight on deep systemic vulnerabilities within digital supply chains.

The findings come following the Digital Operational Resilience Act (DORA) having come into force in January 2025, which increased regulatory pressure on financial institutions to bolster third-party risk management and cyber resilience frameworks.

The vast majority – 96% – of Europe’s top 100 financial institutions experiences at least one third-party breach in the past year, a dramatic rise from 78% in the previous report from last year.

Similarly, 97% had a breached entity within their fourth-party ecosystem, up from 84%.

Just 7% suffered a direct breach, down from 8%, with malware and insider threats remaining key culprits.

The research also found that 94% of institutions with an ‘A’ cybersecurity rating had no known breaches.

However, 13% of firms were ‘C’ rated or lower, an improvement from 18%, and outperforming the European sector average of 31%.

The UK reported the highest number of third-party breaches, followed by Germany and Switzerland, while Malta, Luxembourg, and Portugal had the lowest exposure and highest average cybersecurity grades.

“A 25% surge in third-party breaches among Europe’s top financial institutions is more than a warning, it is a call to action,” said Corian Kennedy, senior manager of threat insights and attribution at SecurityScorecard.

Recommended reading

• Comment | The Growing Threat of Third-Party Cyber Risks
• Third-party and Personal Devices Driving Cyber Vulnerabilities
• Third-party Attack Vectors Plague Insurance Companies
• Third-Party Risks Driving Cyber Insurance Claims

“Cyber threats are no longer confined to the perimeter. They are embedded deep within supply chains. Institutions must evolve from reactive to proactive defence strategies to meet the escalating challenge.”

According to SecurityScorecard’s data, just ten threat actor groups were responsible for 44% of global cyber incidents, with C10p, APT28, and Cobalt Group leading in third-party exploitation. Meanwhile, dependence on a small group of vendors continues to amplify risk, as 15 companies now represent 62% of the global tech market.

Events like the MOVEit vulnerability, which caused over $65 billion USD in damages, reveal how a single weak link can disrupt operations across thousands of downstream entities.