Black Kite
published its sixth annual Third Party Breach Report, which provides deep analysis of
public breaches and regulatory filings from 2024, along with proprietary data
collected by the Black Kite Research and Intelligence Team (BRITE). The report
shows that “silent breaches” lurking within interconnected ecosystems dominated
in 2024. Threat actors capitalized on systemic vulnerabilities, turning trusted
vendor relationships into gateways for disruption and creating cascading
effects that wreaked havoc on industries such as healthcare, retail, and
logistics.
“Digital
interconnectedness drives progress, but it also heightens risk. Because of our
increasing reliance on software platforms and tools, the exploitation of a
single vulnerability can have a catastrophic impact,” said Ferhat Dikbiyik,
chief research and intelligence officer at Black Kite. “Amidst these
challenges, critical lessons emerged, revealing pathways to resilience and
improved cybersecurity practices. BRITE research offers a detailed look at
these findings to inform cybersecurity leaders as they build their 2025
strategies.”
Trends
in methods of compromise
The report reveals how “silent breaches” underscore the risk posed by unseen
vulnerabilities in third-party networks. By exploiting these hidden weaknesses,
attackers not only disrupted individual organizations but also exposed the
fragility of entire supply chains. BRITE uncovered the following trends:
- Unauthorized
network access accounted for more than 50% of publicly disclosed
third-party breaches in 2024. - Ransomware
remained one of the most disruptive cyberthreats in 2024 – accounting for
66.7% of known attack methods – with attackers increasingly leveraging
third-party vectors to amplify their impact. - Software
vulnerabilities continued to pose significant risks in 2024, including the
exploitation of zero-day vulnerabilities. These vulnerabilities
predominantly affected internet-facing network devices, operating systems,
and widely used applications, underscoring the continued reliance of
attackers on unpatched or misconfigured systems. - Credential
misuse emerged as a growing avenue for data breaches in 2024, accounting
for nearly 8% of known attack methods. Public data breaches and credential
dumps on dark web marketplaces provided a steady supply of compromised
credentials, and the rise of automated tools for credential stuffing and
brute force attacks further exacerbated this trend. - One
out of every four third-party breaches in 2024 originated with software
vendors, which demonstrates a shift away from previously highly targeted
areas – technical services represented only 11.5% of breaches in 2024 –
indicating a growing preference for targeting software supply chains as
organizations further digitize their operations.
“The
cyberthreat landscape in 2024 was shaped by evolving attack methods and
persistent vulnerabilities, with many incidents exploiting the
interconnectedness of third-party relationships,” said Dikbiyik. “As
organizations increasingly rely on third-party vendors, attackers have adapted
their strategies to exploit these dependencies, leading to cascading risks
across industries.”
But there is
good news: BRITE’s research also shows improvements in cybersecurity posture
after incidents across many industries. Healthcare vendors, which were
responsible for 9% of third-party breaches in 2024, had the most change, with
62.5% achieving better grades following an incident. This can be partially
attributed to regulatory requirements in frameworks like HIPAA, which continue
to drive advancements in cybersecurity posture. Similarly, 33% of financial
services providers improved. In contrast, only 21.7% of software services
vendors, which face relatively less regulatory pressure, showed measurable
improvement.
Healthcare
remains the most impacted industry
Healthcare organizations accounted for 41.2% of third-party breaches in 2024.
This dominance is attributed to the high value of patient data, operational
dependencies on third-party providers, and the sector’s inherent
vulnerabilities. Finance & Insurance (14.9%) and Manufacturing (14%)
followed as industries most affected by third-party breaches, underscoring the
disproportionate risk faced by these critical sectors.
The report
also includes an in-depth analysis of the most notable cyber incidents of 2024,
including Cencora, Change Healthcare, Snowflake, Crowdstrike, Blue Yonder,
Cleo, and more. Readers will find recommendations for strengthening their
cybersecurity practices to avoid costly, disruptive third-party breaches, such
as the adoption of proactive monitoring, robust risk assessments, vendor
collaboration, and more.
