Security researchers at Black Kite have warned that a vast, largely hidden layer of third‑party breaches went unreported last year, exposing tens of thousands of supply‑chain firms and more than 433 million people.

The cyber firm’s seventh annual Third-Party Breach Report reveals a surge in third‑party incidents last year, recording 136 major events, but while 719 companies were publicly identified as victims, the report found a further 26,000 organisations were caught up in these breaches but never named.

Black Kite says this “shadow layer” of victims has emerged because the impact of breaches rippled through networks quicker than companies were reporting them, with single compromises increasingly translating into multi-company impact – putting many downstream organisations at risk.

Last year, an average of 5.28 downstream victims were identified per third-party breach, by far the highest level observed to date and a significant spike from the 2.56 average seen in 2024.

According to Black Kite, this uptick reflects a sharp increase in the scale and coordination of attacks, driven by threat actors targeting shared platforms, centralised services, and high-dependency vendors. 

But while detection is slow, disclosure is slower, with the study pointing to a persistent “silent window” between internal awareness of a breach and public notification.

Black Kite found that although intrusions were detected in a median of 10 days, companies waited a median of 73 days to go public, a delay that the report argues shifted enormous risk from vendors and onto downstream customers, who had no idea they had been exposed.

Making things worse, the tech ecosystem is suffering from dangerously concentrated risk, with 70% of the top fifty vendors shared by the Forbes Global 2000 having at least one vulnerability currently listed in the CISA KEV catalogue, and 62% with corporate credentials showing up in stealer logs.

Added to that, 80% show phishing URL exposure, while 40% show active targeting signal. Unsurprisingly, more than half (52%) have a recent breach history, with 18% of top vendors impacted in the last year.

Recommended reading

• Report: Supply Chain Attacks a ‘Daily Reality’ As Vendor Security Lags
• Supply Chain Security Risks “Unmanageable”, Cyber Leaders Say
• What Key Cyber Risks Are Supply Chains Facing?

“Traditional third-party risk management is not keeping pace with the reality of today’s threats,” said Ferhat Dikbiyik, chief research and intelligence officer at Black Kite. 

“Over the past year, these risks have transformed from a series of isolated accidents into a systematic crisis. Supply chains are actually most fragile at their highest points of connection. Knowing this, it’s imperative that security teams understand where risk enters, where it concentrates, and how it propagates, and to get there, they need to shift toward active intelligence and systematic awareness.”