Your Supplier's Access is Your Attack Surface

For financial institutions and investors, the lesson is familiar but sharper than ever: your resilience is only as strong as the weakest party with access to your systems, your data or your customers.

Five Suppliers in one week

1. A contractor takes down a national service. A security incident at BAE Systems, which runs the US courts’ Bankruptcy Noticing Center, has halted bankruptcy notices for every federal bankruptcy court.³ BAE first alerted the courts late on 9 October and says the incident is “isolated to the BNC system”. As of 16 October, no date had been given for restoring services.⁴ The courts’ own systems were not the target; the contractor’s were.
2. Supplier-managed technology becomes the attack path. Overnight on 11 October, attackers remotely triggered the defrost function on refrigeration units across hundreds of French supermarkets, including Intermarché, Netto, Coopérative U, Carrefour and Monoprix stores.⁵ Danfoss, which supplies the controllers, has told Reuters it is aware of incidents affecting “a limited number” of its refrigeration management systems, mostly older models that no longer receive security updates. France’s cyber agency, ANSSI, is involved and the Paris prosecutor has opened an inquiry.⁶
3. A reseller in the hardware chain. On 13 October, Ledger said hidden implants in wallets sold through one South-East Asian reseller captured users' recovery phrases and sent them out over a build-in mobile connection. The tampered devices could still pass Ledger's authenticity checks.⁷
4. The vendor products at the edge of every network. Within days of each other, Ivanti Connect Secure VPNs, Palo Alto Networks PAN-OS firewalls and Cisco secure Email Gateways were all confirmed as exploited zero-days.^8,9 The Cisco flaw (CVE-2026-76519, CVSS 9.8) lets an unauthenticated attacker gain root access to the appliance with a single email carrying a crafted attachment.¹⁰ These are the security tools firms buy to keep attackers out.
5. Regulators hold the principal liable for its agents. On 12 October, the EDPB published the Italian data protection authority's €16.7m fine against Wind Tre. Among the findings: inadequate controls over its sales network, which sent marketing without valid consent and activated contracts customers didn’t know about. Outsourcing the activity did not outsource the accountability.¹¹

The Common Thread

These incidents span courts, grocery retail, hardware and telecoms, but they fail in the same three ways.

• Access. Each supplier held standing access to systems, devices or customers that the buyer could not see into directly, in some cases through technology that no longer received security updates.
• Concentration. One provider served the whole bankruptcy system, and one supplier's controllers sat in hundreds of stores. When a shared dependency fails, everyone who relies on it fails together. 
• Visibility. In most cases the affected organisation learned of the problem from the outcome (halted notices, warm fridges, drained wallets) rather than from monitoring its supplier. 

Financial services are no different. Custodians, administrators, cloud and software providers, and the security appliances on every network edge all carry the same exposure. 

For investors, the exposure compounds. Where several portfolio companies rely on the same fund administrator, cloud platform or managed service provider, concentration risk in the supply chain becomes concentration in the portfolio. A Single supplier failure can surface across several holdings at once, and it rarely shows up in a data room unless someone goes looking for it. 

Regulators are closing the gap

In the EU, DORA already makes financial entities answerable for ICT third-party risk. Firms must keep a register of their ICT providers, assess concentration risk and build exit strategies for critical services. 

The UK is following. The Cyber Security and Resilience Bill brings managed service providers and data centres into scope and lets regulators designate "critical suppliers". As currently drafted, it requires an initial incident report within 24 hours and a full notification within 72 hours. The most serious breaches can draw fines of up to £17m or 4% of worldwide turnover, whichever is higher.^12,13

The Bill is now in the House of Lords, with Report Stage scheduled for 26 October. That is the first point at which peers can vote on amendments, so the detail may still change.¹⁴

What do do now

1. Map who has access, not just who you pay. List every supplier with access to your systems, data or customers, including resellers, sales agents and the vendors behind your security appliances. 
2. Find your shared dependencies. Identify the single providers that many of your critical services rely on, and test what happens if one goes dark. Investors should run the same exercise across portfolio companies. 
3. Monitor continuously. An annual questionnaire would not have caught any of last week's incidents. Track suppliers' external security posture and exposure to known exploited flaws as they emerge.
4. Write the exit and the incident playbook first. Agree notification duties, timelines and fallback arrangements in contracts before you need them. The UK's proposed 24-hour reporting clock leaves no time to negotiate.
5. Bring supplier risk into due diligence. For new investments and acquisitions, assess the target's critical suppliers and shared dependencies alongside its own security posture. An inherited dependency is an inherited exposure. 

Operational resilience is now won or lost in the supply chain, and regulators on both sides of the Channel expect firms to show they have it in hand. Thomas Murray helps financial institutions and investors see and manage that risk across their supplier and counterparty networks. 

1. Scope of Asos data breach wider than first reported, Computer Weekly, 8 October 2026
2. Asos hackers claim responsibility for Air France-KLM data breach, City AM, 12 October 2026
3. Federal bankruptcy courts dealing with outages after contractor cyberattack, The Record, 15 October 2026
4. BAE Systems security incident stalls notices from US bankruptcy courts, SecurityWeek, 16 October 2026
5. Cyberattack disrupts refrigeration at hundreds of French supermarkets, The Record, 11 October 2026
6. Attackers heat French supermarket fridges by hijacking Danfoss controllers, The Hacker News, 13 October 2026
7. Ledger says hardware implant in cryptocurrency wallets stole recovery phrases, The Record, 13 October 2026
8. CISA warns of new Ivanti bug being exploited, The Record, 14 October 2026
9. Palo Alto Networks patches PAN-OS zero-day exploited for remote code execution, SecurityWeek, 15 October 2026
10. Cisco make-me-root email bug exploited as a 0-day, The Register, 14 October 2026
11. Italian DPA fines Wind Tre EUR 16,700,000 for unlawful telemarketing, EDPB, 12 October 2026
12. Cyber Security and Resilience (Network and Information Systems) Bill introduced to Parliament, Mayer Brown, November 2025
13. The Cyber Security and Resilience Bill: what it means, Cyjax, accessed 16 October 2026
14. Cyber Security and Resilience (Network and Information Systems) Bill: stages, UK Parliament, accessed 19 October 2026