The deep work behind
the wire.
Research-led explainers, breach postmortems, regulatory briefs, and playbooks. Long-form work from the Supplier Shield desk and Abilene Advisors partners.
Matches titles, excerpts, categories, and author bylines.
Every long read.
Long readJscrambler's own npm package was hijacked: a trusted supplier became a supply-chain vector
An attacker hijacked Jscrambler's npm package with a stolen publishing credential and shipped an infostealer to developers between 11 and 13 July 2026. The malware harvested cloud tokens, wallets and AI-assistant credentials from any machine that installed it. For third-party risk teams, the lesson is that a trusted dependency is a supplier, and its release channel can become the attack path.
Long readLidl online shop data breach started at an IT service provider, not the retailer's own systems
Lidl has told online shop customers in Germany, Belgium and the Netherlands that their data was stolen in a breach at an IT service provider, not in its own systems. Names, phone numbers, email addresses, dates of birth and customer numbers were taken; payment data is not yet ruled out. Under GDPR the controller stays accountable for a processor's breach.
Long readProgress tells ShareFile customers to pull the plug: an ICT supplier's threat becomes everyone's downtime
On 10 July 2026 Progress Software told ShareFile customers running Storage Zone Controllers to shut down the hosting Windows servers over a credible external threat. No patch, no CVE, and cloud access to affected accounts disabled. The pattern is concentration risk: one widely used file-sharing supplier is a single point of exposure, and its emergency is inherited by everyone downstream, including firms that only touch it through a vendor.
Long readAdaptHealth breach reached patient data through a third-party contractor's stolen credentials
AdaptHealth told the SEC that attackers reached patient data through a third-party contractor's stolen credentials, obtained by social engineering. The number of affected individuals is not yet confirmed. For third-party risk teams, contractor and vendor accounts are part of the attack surface.
Long readDeutsche Bank incident began at a third-party marketing platform, not the bank's network
A cyber incident tied to Deutsche Bank started at a third-party marketing and incentive platform in Germany, not the bank's own network. The Unsafe ransomware group posted alleged employee records; Deutsche Bank says its systems were not affected and the scope is unconfirmed. For financial firms, the lesson is a DORA register one: an edge supplier that holds employee or partner data still belongs in scope.
Long readHemmersbach ransomware claim: why a breach at an IT services supplier reaches toward its clients
A ransomware group has claimed a breach of Hemmersbach, a German IT services provider that works inside its clients' technology estates. Researchers say the exposed data includes credentials to the firm's own identity systems. Hemmersbach has not confirmed the attack and the scope is unverified. For third-party risk teams, the lesson is about vendor access: a supplier's stolen login can become a route toward the clients it serves.
Long readFake Paysafe, Skrill and Neteller SDKs on npm and PyPI turned payment developers into a supply-chain target
Researchers found 17 fake Paysafe, Skrill and Neteller packages on npm and PyPI that steal API keys and CI tokens from developer and build machines. Nothing was breached at the payment firms. The exposure came through a poisoned dependency, which shows why the package registry is a supplier.
Long readAccenture breach: source code and cloud keys claimed stolen from a supplier many firms rely on
Accenture confirmed a security incident on 8 July 2026 after a threat actor listed about 35 GB of source code and cloud access keys for sale. The company called it isolated and remediated, but did not confirm scope or client-data impact. For third-party risk teams, the exposure is the client pipelines and cloud tenants a services provider touches.
Long readKDDI email breach: how one shared email platform exposed up to 14.2 million logins across six ISPs
One email platform run by KDDI exposed the logins of up to 14.2 million customers across six Japanese internet providers. The lesson for third-party risk teams is concentration and fourth-party risk: many brands on one shared supplier system, breached through a third-party software flaw.
Long readiRhythm breach: how patient data left through third-party-hosted business apps
Cardiac-monitoring firm iRhythm says attackers took patient health data, proprietary data and personal information from third-party-hosted business applications, not from its clinical systems. For third-party risk teams the lesson is that regulated data often lives with a vendor, and that is where it leaves.
Long readKlue OAuth breach: how one connected app exposed CRM data at Huntress, Jamf and other customers
The Icarus extortion group stole the OAuth tokens Klue held for its customers and used them to take data from those customers' own Salesforce and Gong accounts. For third-party risk teams the lesson is fourth-party risk: a connected SaaS app can turn a supplier's breach into your data loss.
Long readVendor due diligence: the 2026 checklist for regulated teams
A practical vendor due diligence checklist for 2026, tiered by risk and mapped to what DORA, NIS2, and GDPR now expect, including the fourth-party checks most teams skip.
Long readOracle PeopleSoft zero-day (CVE-2026-35273): how one HR platform breached 100-plus organisations
A single Oracle PeopleSoft zero-day let the ShinyHunters group breach more than 100 organisations, from the University of Nottingham to Nissan. The lesson for third-party risk teams is concentration risk: shared vendor software turns one flaw into many incidents at once.
Cross-Border Data Transfers Between Switzerland and France: A Compliance Guide
Personal data flows freely between Switzerland and France in both directions with no SCCs required. Learn when SCCs and Transfer Impact Assessments apply, how FADP Article 9 compares to GDPR Article 28, and what financial-sector overlays apply.
.png&w=3840&q=75)
Long readAmazon employee data breach exposes hidden dangers in the digital supply chain
Amazon’s recent data breach reveals hidden risks in third-party vendors. Learn how proactive supply chain security can help prevent such vulnerabilities.
.png&w=3840&q=75)
Long readBrowsers: The new AI battleground and 2025�s biggest security test
Browsers are the new AI security battleground. Anthropic�s Claude for Chrome shows how browser agents can boost productivity but expose enterprises to prompt injection, data leaks, and governance risks. Learn why AI browser security, agentic workflows, and third-party risk management must be built i...
Long readCould scrapping IP laws supercharge AI—or leave your business exposed?
As Dorsey and Musk push to scrap IP laws, learn how this AI shift could expose your business to third-party risks—and how to stay protected.
.png&w=3840&q=75)
Long readCyber supply chain risk management: From visibility gaps to resilience at scale
Build a resilient cyber supply chain risk management program. Learn the latest market trends, key challenges, future predictions, and real-world case studies. Get a 90-day plan to reduce vendor risk and meet regulations like NIS2 and DORA.
Long readData transfer regulations: Impact on Swiss and USA companies
Discover how data transfer regulations impact Swiss and U.S. companies. Learn about the Swiss FADP, U.S. national security rules, and how Supplier Shield helps businesses navigate compliance with expert advisory, managed services, and a secure cloud platform.
.png&w=3840&q=75)
Long readDeepSeek vs ChatGPT: What they mean for supplier risk management
DeepSeek AI vs. ChatGPT: A look at features, risks, and data privacy concerns. Learn how supply risk management can help businesses stay secure.
Long readDetailed analysis: Why EU and Swiss companies must rely on European-rooted cybersecurity partners
In a shifting geopolitical world, discover why European-rooted cybersecurity partners are critical for EU and Swiss organizations. Explore the growing supply chain threats, legal risks with U.S. tech providers, and the importance of digital sovereignty in third-party risk management (TPRM).
Long readEmpowering procurement-led third-party risk management
Learn how procurement-led third-party risk management supports NIS2 compliance, boosts resilience, and improves supplier oversight.
.png&w=3840&q=75)
Long readEmpowering TPRM: Essential resources and tools for effective risk management
Manage third-party risk with TPRM tools. Automate assessments, ensure compliance, and get real-time threat intelligence. Learn more in our guide.
.png&w=3840&q=75)
Long readEnsuring continual excellence: Monitoring and managing third-party performance
Manage third-party performance with our guide. Set metrics, use monitoring tools, and conduct reviews. Streamline with TPRM solutions like Supplier Shield.
Long readEU Digital Operational Resilience Act (DORA) & third-party risk management (TPRM) 2025
Learn how DORA strengthens financial resilience through third-party risk management, compliance, and ICT vendor oversight for EU firms.
.png&w=3840&q=75)
Long readFinancial services vendor risk management under new regulatory pressure
Financial services vendor risk under new regulatory pressure: explore banking third‑party risk, DORA compliance for vendors, and vendor risk strategies.
Long readFrom vendor breach to boardroom liability: How the EU AI act changes accountability for suppliers
The EU AI Act makes both vendors and buyers liable for supplier AI failures, fines can reach €35M or 7% of turnover. Supplier Shield helps you track and mitigate that risk.
.webp&w=3840&q=75)
Long readHow 4.2 Million Internet Hosts Were Hijacked: What You Need to Know
Discover how vulnerabilities in tunneling protocols expose 4.2M internet hosts to attacks. Learn about the risks, affected regions, and essential steps to protect your network and supply chain.
.png&w=3840&q=75)
Long readHow can financial risks in a supply chain be managed?
Learn how to manage financial risks in supply chains effectively. Discover strategies to mitigate supplier instability, credit risks, and market volatility for resilient operations.
.png&w=3840&q=75)
Long readHow can I identify and assess the risks posed by my third parties?
Simplify third-party risk management with Supplier Shield. Identify risks, implement strategies, collaborate, monitor, protect data, and boost efficiency.
.png&w=3840&q=75)
Long readHow Supplier Shield enhances GDPR compliance in vendor management
Learn how Supplier Shield improves GDPR compliance in vendor management with automated risk assessments, consent tracking, and breach notifications.
.png&w=3840&q=75)
Long readHow Supplier Shield protects against data breach risks from third-party vulnerabilities
Discover how Supplier Shield helps mitigate risks from third-party and supplier vulnerabilities, protecting businesses from different risks.
.png&w=3840&q=75)
Long readLet’s talk about the landscape of third-party risks: A comprehensive overview
Effectively manage third-party risks with TPRM tools. Identify and mitigate cybersecurity, financial, and compliance risks. Learn more with our guide.
.png&w=3840&q=75)
Long readMastering NIS2 compliance: A no-nonsense guide for businesses
Learn how NIS2 changes cybersecurity rules for EU businesses, the risks of non-compliance, and how real-world strategies can help you meet the 2024 deadline and strengthen your security posture.
.png&w=3840&q=75)
Long readMastering supplier risk management: Your ultimate guide to building resilient and transparent supply chains
Learn how to effectively manage supplier risks by identifying, assessing, and mitigating potential disruptions to ensure smooth operations and compliance.
.png&w=3840&q=75)
Long readMaximizing efficiency and cost-effectiveness in TPRM programs
Prioritize high-risk vendors, use advanced TPRM tools, and standardize processes. Save costs and mitigate risks. Learn more in our guide.
.png&w=3840&q=75)
Long readNavigating regulatory waters: Key compliance considerations for TPRM
Struggling with TPRM? Our guide covers GDPR, HIPAA, PCI DSS, and more. Learn robust strategies and advanced solutions. Stay compliant and secure.
Long readNIS2 compliance in manufacturing: how to secure your supply chain and meet EU requirements
Discover how manufacturers can achieve NIS2 compliance, secure their supply chains, and reduce third-party risk. Learn practical steps and see how Supplier Shield simplifies compliance.
.png&w=3840&q=75)
Long readResponding to third-party security breaches: A clear action plan
Prepare for third-party breaches. Create a response plan, activate a team, and use advanced tech for monitoring. Learn more in our guide.
.png&w=3840&q=75)
Long readSecure onboarding and contracting: TPRM best practices
Simplify third-party onboarding. Learn to create frameworks, conduct due diligence, use TPRM tools, and establish clear contracts. Enhance resilience.
.png&w=3840&q=75)
Long readShowcasing TPRM success: Communicating effectiveness to stakeholders
Win stakeholder support for TPRM by tracking KPIs, risk reduction, demonstrating compliance, improving vendor performance, and leveraging technology.
.png&w=3840&q=75)
Long readStarbucks faces cyber attack fallout: Could your coffee routine be at risk?
Ransomware hits Starbucks supply chain—barista pay and schedules disrupted. Could your daily coffee fix be next? Here's what you need to know!
.png&w=3840&q=75)
Long readSupplier risk management best practices to protect your supply chain in 2025
Explore supplier risk management best practices to mitigate disruptions, build resilient supply chains, and embrace future trends like blockchain and IoT.
.png&w=3840&q=75)
Long readThe best third-party risk management software for teams still stuck in Excel
Still managing vendor risk in Excel? This guide compares the top TPRM software of 2025, and shows why Swiss-built Supplier Shield is the go-to choice for lean teams ready to scale.
.png&w=3840&q=75)
Long readThe hidden costs of Inadequate TPRM: A Swiss perspective
Uncover the hidden costs of poor TPRM in Switzerland. Learn how to protect your business from financial, reputational, and operational risks
.webp&w=3840&q=75)
Long readThe hidden risks of AI: What businesses can learn from AI cheating in chess
AI isn't perfect�learn from chess AI cheating incidents and find out how to safeguard your business against emerging cyber threats
.png&w=3840&q=75)
Long readThe Importance of third-party risk management in Switzerland's strict regulatory framework
Discover how Swiss regulations impact third-party risks. Learn to protect your business, ensure compliance, and thrive in a complex regulatory landscape.
.png&w=3840&q=75)
Long readThe ultimate guide to building a risk-aware culture: strategies top companies use
Learn how top companies build a risk-aware culture to navigate emerging risks, improve decision-making, and boost resilience through training, technology, and certifications.
.png&w=3840&q=75)
Long readThe ultimate guide to cybersecurity vendor risk management (VRM) in 2024
Discover the importance of cybersecurity vendor risk management (VRM) in safeguarding your organization. Learn key strategies, best practices, and how to mitigate risks from third-party vendors effectively.
.png&w=3840&q=75)
Long readThe ultimate guide to supplier compliance management: Mastering TPRM in 2025
Master supplier compliance management with this comprehensive guide. Explore key components, best practices, challenges, and future trends to enhance risk mitigation and ensure regulatory adherence.
Long readThird-party risk management software: What you need to know in 2025
Compare top third-party risk management software for EU & Swiss companies. Discover tools aligned with NIS2, GDPR & DORA—without enterprise complexity.
.png&w=3840&q=75)
Long readTop 7 UK third-party risk management challenges: overcoming compliance hurdles
Third-party relationships drive innovation but introduce risks. A KPMG survey found 72% of financial services firms faced operational disruptions from third-party incidents. UK companies must manage these risks while complying with regulations like GDPR.
.png&w=3840&q=75)
Long readUBS and DSM-Firmenich hit by employee data theft in major cyberattack
UBS and DSM-Firmenich data breach exposes 7.9M employees. Learn how proactive vendor risk management can prevent third-party vulnerabilities.
.png&w=3840&q=75)
Long readUnderstanding TPRM: Managing third-party risks for organizational resilience
Discover TPRM: what it is, why it matters, and how to implement it. Learn how to identify and mitigate risks from outsourcing to third-party vendors.
.png&w=3840&q=75)
Long readWhat if your private conversations were leaked? Worst telecom hack in USA history.
Protect your business from telecom hacks like Salt Typhoon. Secure networks, protect data, and build trust with proactive cybersecurity solutions.
.png&w=3840&q=75)
Long readWhat is Supplier Shield? Your guide to streamlining supplier risks and compliance
Discover what Supplier Shield is and how our managed service helps businesses reduce supplier risks, ensure compliance, and improve efficiency.
.png&w=3840&q=75)
Long readWhat is the Best TPRM Software for European Companies in 2026?
Compare 10 top TPRM software solutions for NIS2 and DORA compliance. Honest reviews, pricing, EU features, and implementation times. Updated Mar 2026.
Long readWhat Is the EU AI Act? Complete Guide (2025)
EU AI Act is the world's first AI regulation with penalties up to €35M. Learn risk categories, compliance deadlines (2025-2027), and high-risk AI requirements.
%2520Definition%252C%2520Examples%2520%2526%25202025%2520Data.png&w=3840&q=75)
Long readWhat Is TPRM? Third-Party Risk Management Explained (2025)
TPRM manages risks from vendors, suppliers, and partners. Learn why 30% of breaches involve third parties and how to implement TPRM for NIS2 and DORA compliance.