Frameworks, analysis, and guidance across TPRM, supply chain risk, and vendor governance.
Incident ManagementWhen American Medical Collection Agency (AMCA) failed in its security controls, Labcorp faced a $2.3 million settlement and court-mandated security reforms after 10.2 million customer records were exp
Incident ManagementWhen BigCommerce confirmed that compromised credentials for third-party Ribon applications had been used to inject malicious scripts into merchant stores on September 17, it highlighted a critical vul
Incident ManagementWhat Happened In September 2025, a ransomware attack forced Jaguar Land Rover to shut down its UK plants, halting production of about 1,000 luxury vehicles per day. This disruption affected over 5,000
Incident ManagementWhen Brevo s compromised Cloudflare API key went undetected from late August until it was weaponized on September 14, the company joined a growing list of organizations that discovered their third-par
Get weekly security insights and compliance updates delivered to your inbox.
Incident ManagementYou ve secured your source repositories. Your API keys live in private repos, not public ones. Your CDN handles the edge logic. You re covered, right? That s what Brevo thought before attackers used a
Incident ManagementYour logistics team just confirmed a carrier for tomorrow s pickup. The account matched your approved list, the email domain looked right, and the phone number was in your system. However, criminals r
Incident ManagementThe Problem Your vendor operates a crucial F5 BIG-IP APM device. It s patched and monitored under your standard security controls. Then a rootkit exploits CVE-2025-53521, injecting a fileless web shel
Incident ManagementWhat Happened On September 5, 2025, The Gentlemen ransomware group listed Veradigm (formerly Allscripts Healthcare Solutions) on its leak site, claiming to hold 3.5 million patient records. The Chicag
Incident ManagementA data deletion clause is only effective if you enforce it. Trezor s breach shows the consequences of failing to do so: ShipMonk retained customer data for three years after confirming deletion, incre
Incident ManagementWhen IDscan.net s breach exposed 153 million driving licenses, plus millions more identity documents, the FBI opened an investigation. But for enterprises using IDscan.net, Hertz, Target, FedEx, Caesa
Incident ManagementYour routers aren t just passing packets. According to Sygnia ’s analysis of the Fire Ant campaign, they re serving as surveillance platforms for sophisticated state-backed actors. These actors exploi
Incident ManagementWhen attackers breach third-party applications through social engineering, your incident response begins with a crucial question: what access did that vendor have, and who controls it now? The McKesso
Incident ManagementYou re reviewing a vendor s security questionnaire. They ve answered Yes to encryption in transit. You check the box and move on. Then 157 gigabytes of factory schematics, badge request forms, and pas
Incident ManagementWhen ZBT routers, sold globally as white-label products, were found to contain manufacturer-implanted backdoors, it exposed a critical gap in hardware procurement controls. These routers reached organ
Incident ManagementWhen Ceva Logistics confirmed a breach affecting eight European warehouses between July 29 and August 1, it exposed more than customer data. It revealed a widespread misunderstanding of logistics prov
Incident ManagementThe Conventional Wisdom When ransomware attacks surge, the industry response is predictable: patch faster, monitor harder, train users better. Black Kite s report showing a 55.1% year-over-year increa
Incident ManagementThe Challenge On June 8, 2017, UpGuard s Cyber Risk Team discovered a publicly accessible Amazon Web Services S3 bucket containing Verizon customer data, names, addresses, account details, and account
