A new study has surfaced a major cybersecurity concern for businesses: security vulnerabilities from third-party partners. According to a recent report by SecurityScorecard, more than a third of all data breaches in 2024 were linked to third-party service providers.
Underreported Threats
The research examined 1,000 cybersecurity incidents across different industries and regions. It found that 35.5% of breaches were due to third-party security weaknesses. However, experts believe the real number may be even higher due to many incidents being misclassified or not reported.
High-Risk Sectors
The report also revealed that the nature of these attacks is changing. In 2025, fewer third-party breaches involved technology services than in previous years. Only 46.75% of such breaches were linked to tech-related businesses, a decline from 75% the year before. This means cybercriminals are targeting a broader range of industries.
Among the most affected industries were retail and hospitality, which experienced the highest rate of third-party security breaches at 52.4%. The technology sector followed closely at 47.3%, while energy and utility companies saw a 46.7% breach rate. Even though the healthcare industry had a lower percentage of breaches (32.2%), it faced the highest total number of attacks, with 78 incidents recorded.
Global Hotspots for Third-Party Breaches
Certain countries saw a higher frequency of breaches. Singapore reported the most third-party cyber incidents, with 71.4% of breaches originating from external vendors. The Netherlands followed at 70.4%, while Japan recorded 60%.
The report also pointed out that ransomware groups are increasingly exploiting third-party connections to gain access to their targets. More than 41.4% of ransomware attacks now originate through a compromised third-party vendor. The notorious Cl0p ransomware gang has been particularly active in using this method.
Strengthening Security Measures
Cybercriminals favor third-party breaches because they allow access to multiple organizations at once. Security experts warn that businesses need to move away from occasional security checks of their vendors and instead implement continuous monitoring. By keeping a close watch on external partners' security measures, companies can reduce the risk of cyber threats before they escalate into major breaches.
