third party risk3 articles
EY Breach Exposes Client Tax Data Including SSNs and Card Numbers
Ernst & Young (EY) has begun notifying clients of a data breach involving a third-party service management platform used for tax-related work, with hackers gaining access between March 28 and April 12 after the incident was discovered on April 23. The compromised data includes sensitive personal and financial information such as names, addresses, Social Security numbers, and credit/debit card numbers. EY states it is unaware of any misuse of the data and is offering affected clients two years of free credit monitoring and identity protection services.
AdaptHealth Blames Social Engineering After Patient Data Walks Out the Door
Medical equipment provider AdaptHealth suffered a cyberattack in which criminals used social engineering to compromise a third-party contractor and gain access to the company's cloud systems. Attackers stole sensitive patient data, including personally identifiable information, protected health information, and a password file linked to insurance billing, though Social Security numbers and payment details are believed to be unaffected. AdaptHealth disclosed the breach to the SEC on June 27, deeming it material due to the potential volume of data at risk, while investigations into the full scope of the incident are ongoing.
Why Cyber Resilience Has Swallowed Business Continuity Planning
Modern business disruption increasingly originates from cyber threats such as ransomware, identity compromises, and supplier or cloud failures, making cyber resilience the new foundation of business continuity planning. Effective continuity requires organisations to map critical processes and dependencies, integrate governance, incident response, and supplier management into a unified framework, and ensure systems can recover within agreed timeframes. Crucially, continuity plans must be regularly tested against realistic scenarios to verify they hold up under real pressure, not just on paper.