Topic

Third-Party Risk: news, advisories and analysis

10 articlesUpdated 23 Oct 2026

CyberSecureToday covers Third-Party Risk across 10 articles published between 20 Sep 2026 and 23 Oct 2026. The coverage includes 4 incident or breach reports and 6 analysis or guidance pieces.

Stories on Third-Party Risk most often intersect with Data Breach, Banking Security and Compliance, with Banking, Financial Services & Fintech the most affected sector. The most recent story, “RBI IT Governance & Cybersecurity Master Direction for NBFCs: Implementation Playbook”, was published 23 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

GuidesBanking & Fintech
RBI IT Governance & Cybersecurity Master Direction for NBFCs: Implementation Playbook
A comprehensive implementation guide for NBFCs navigating RBI Master Directions on IT governance, 6-hour incident disclosure, vendor audits, and VAPT.
Priya Raman23 Oct 202614 min read
InsightsBanking & Fintech
EU DORA Standards Set Major ICT Incident Classification and Third-Party Oversight Rules
European Supervisory Authorities finalize binding technical standards under the Digital Operational Resilience Act (DORA), requiring 4-hour intermediate incident disclosures.
CST Editorial Desk9 Oct 20268 min read
Cyber AttackCloud & SaaS
SEC Form 8-K Forensics: Advanced Semiconductor Foundry Discloses Intellectual Property Theft via Compromised Supplier VPN
Material SEC 8-K disclosure reveals advanced nation-state threat actors pivoted through a third-party equipment vendor SSL VPN to exfiltrate proprietary lithography recipes.
Priya Raman8 Oct 20268 min read
InsightsGov & Defence
Denmark's 8.8 Million CPR Breach Exposes Trusted Partner API Blind Spot
The exfiltration of 8.8M Danish CPR records exposes the systemic risk of partner API queries. Security leaders must replace static trust with verifiable credentials.
Priya Raman6 Oct 20269 min read
Cyber AttackGov & Defence
Compromised Partner Integration Exposes 8.8 Million Citizen Records in Denmark National Registry Breach
Danish authorities confirmed an unauthorized entity abused legitimate commercial partner API credentials to exfiltrate 8.8 million CPR citizen identity records.
Tom Verhoeven5 Oct 20268 min read
InsightsBanking & Fintech
EU DORA Mandates 4-Hour ICT Incident Disclosure and Threat-Led Penetration Testing
European supervisory authorities enforce EU DORA standards, requiring financial institutions to implement 4-hour major ICT incident disclosure and strict third-party cloud oversight.
Mei-Lin Chen25 Sep 202618 min read
InsightsBanking & Fintech
RBI Enforces 6-Hour Breach Notification and Cloud Outsourcing Audits Across Financial Sector
RBI accelerates enforcement of its IT Governance Master Direction, mandating 6-hour incident reporting and strict third-party cloud outsourcing audits for financial entities.
Tom Verhoeven24 Sep 202618 min read
Cyber AttackBanking & Fintech
Navient Corporation Files SEC Form 8-K After Third-Party Law Firm Ransomware Exfiltrates Borrower Records
Navient files SEC Form 8-K Item 1.05 after a ransomware attack on an external law firm exposed sensitive student loan borrower PII and Social Security numbers.
CST Editorial Desk23 Sep 202614 min read
Cyber AttackHealthcare & Pharma
Amgen Discloses Unauthorized Cloud Data Exfiltration and Patient PHI Theft in SEC Form 8-K Filing
Biotechnology giant Amgen files SEC Form 8-K Item 1.05 after unauthorized actors infiltrated third-party cloud environments and exfiltrated sensitive patient PHI and clinical research data.
CST Editorial Desk22 Sep 202616 min read
InsightsBanking & Fintech
EU DORA Enforcement Shifts to Live Production Penetration Testing and Third-Party Oversight
European financial regulators transition DORA enforcement to mandatory Threat-Led Penetration Testing (TLPT) and direct scrutiny of Critical ICT Third-Party Providers.
Priya Raman20 Sep 202613 min read