SecurityScorecard has released its 2025 Global Third-Party Breach Report, uncovering insights into supply chain vulnerabilities and the growing exploitation of vendor relationships by cyber criminals.

Leveraging the ‘world’s largest proprietary risk and threat dataset’, SecurityScorecard’s STRIKE Threat Intelligence Unit analysed 1,000 breaches across industries and regions to identify key attack patterns and measure the impact of third-party security failures.

Key Findings

The report highlights a significant surge in third-party breaches, with 35.5% of all breaches in 2024 linked to vendor vulnerabilities – a figure likely understated due to underreporting and misclassification. The technology sector, while still a prime target, saw a decline in third-party breaches (46.75% in 2025, down from 75% last year), signaling a diversification of attack surfaces.

Industries such as retail and hospitality faced the highest third-party breach rate (52.4%), followed closely by technology (47.3%) and energy and utilities (46.7%). Despite recording the most incidents (78 breaches), the healthcare sector had a below-average breach rate (32.2%).

Geographically, Singapore (71.4%), the Netherlands (70.4%), and Japan (60%) emerged as global hotspots for third-party breaches. In contrast, the U.S. reported a lower rate (30.9%), falling 4.6% below the global average.

Ransomware groups are increasingly exploiting third-party access, with 41.4% of ransomware attacks now originating through vendor vulnerabilities. The group C10p was identified as the most prolific user of third-party attack vectors.

Actionable Strategies to Mitigate Risk

To combat these threats, SecurityScorecard recommends:

• Tailoring risk management strategies to organisational risk profiles, accounting for industry, geography, and technology dependencies.
• Mitigating fourth-party risk by enforcing strong third-party risk management (TPRM) programs in vendor contracts.
• Adopting “Secure by Design” technology, ensuring built-in security features and aligning with initiatives like CISA’s Secure by Design framework.
• Hardening high-risk infrastructure, including file transfer software, cloud services, and VPNs, through prompt patching, MFA, and continuous assessments.
• Disrupting ransomware supply chains by refusing ransom payments, which fuel further attacks and often fail to restore data.

The report’s findings are based on a multi-source analysis of open-source intelligence (OSINT), security research, lawsuits, corporate filings, government disclosures, media reports, and underground criminal forums.

Recommended reading

• Arctic Wolf Threat Report: Ransomware As A Service On the Rise
• February 2025 Was The Worst Month in Ransomware History
• NHS Staff Don’t Think They’re Cyber Ready, BT Finds

Ryan Sherstobitoff, SVP of SecurityScorecard’s STRIKE Threat Research and Intelligence, commented on the findings: “Threat actors are prioritising third-party access for its scalability.

“Our research shows ransomware groups and state-sponsored attackers increasingly leveraging supply chains as entry points. To stay ahead of these threats, security leaders must move from periodic vendor reviews to real-time monitoring to contain these risks before they escalate.”