TL;DR
- 1 in 4 data breaches now exploit a vulnerability in a third-party vendor — not your own systems [1]
- When a vendor breach hits, the damage is twice as severe as a direct attack on your business [1]
- This week, 1.4 million Betterment customers were exposed through a social engineering attack on a third-party communications platform [2]
- The fix isn't expensive — it's a mix of vendor vetting, contract clauses, and a few key technical controls
- lil.business can assess your vendor exposure in one session
Your Software Vendor Just Became Your Biggest Security Risk
Every time you sign up for a new SaaS tool, you are trusting that company with a slice of your business. Your customer data. Your financial data. Your employee records. Your communications. And that trust extends to their vendors, and their vendors' vendors.
Free Resource
Get Our Weekly Cybersecurity Digest
Every Thursday: the threats that matter, what they mean for your business, and exactly what to do. Trusted by SMB owners across Australia.
No spam. No tracking. Unsubscribe anytime. Privacy
Weekly Threat Briefing — Free
Curated threat intelligence for Australian SMBs. Active campaigns, new CVEs, and practical mitigations — every week, straight to your inbox.
Subscribe Free →According to Dataminr's 2026 Cyber Threat Landscape Report — released this week and based on 6.3 million external threat alerts — one in four modern breaches now exploit a vulnerability in a third-party vendor, not the target organisation directly [1][8]. That's a 20% higher risk magnitude than a direct attack on your own infrastructure.
Worse: when a vendor pivot breach succeeds, it causes twice the data impact per incident compared to a standard breach [1]. You're not just exposed — you're doubly exposed, because the attacker has already bypassed the first line of defence before you even know you're a target.
What Happened to Betterment's 1.4 Million Customers (And Why It Matters for Your Business)
The Betterment breach, disclosed this week, is a textbook example of the vendor attack chain playing out in real life.
Betterment is an investment platform with over a million customers in the United States. In January 2026, an attacker used social engineering — impersonating someone trusted — to gain access to a third-party platform Betterment used for customer communications [2]. They didn't break into Betterment's servers. They went through the side door: a vendor.
Once inside, the attacker exfiltrated the personal data of approximately 1.4 million customers, including full names, personal and work email addresses, phone numbers, job titles, employer information, retirement plan details, financial interests, and meeting notes [2]. ShinyHunters, a prominent ransomware group, has since published this data publicly after Betterment refused to pay a ransom.
The stolen data includes enough context for highly personalised phishing attacks — someone could receive an email that addresses them by name, references their company's 401(k) plan, and impersonates their financial adviser. This isn't random spam. It's surgical.
According to Malwarebytes, one CSV file in the leaked dataset contained detailed profiles on 181,487 individuals — a "gold mine for phishers" [2]. The same week, Figure, a fintech company, disclosed a breach affecting 1 million customers — also triggered by an employee being socially engineered through a third-party account [3].
Two breaches. Two third-party platforms. Both in the same week.
How Fast Are Vendors Being Weaponised Against You?
The speed of exploitation is what makes vendor vulnerabilities so dangerous for SMBs.
According to Dataminr's 2026 report, 96% of third-party vulnerabilities (CVEs) are weaponised within the same calendar year they are disclosed [1]. That means attackers are not sitting on stockpiles of exploits — they are racing to use new vulnerabilities the moment they are published, frequently before your vendor has patched them, and certainly before you know to ask.
FIRST (Forum of Incident Response and Security Teams) forecasts that 2026 will see a record 50,000 to 59,000+ new CVEs disclosed [4] — up from an already-record 2025. With one in four breaches now coming through vendor CVEs, the maths is stark: the attack surface of every business that uses third-party software is growing faster than most organisations can track.
In some cases, a moderate-severity vulnerability in a vendor's platform can translate to a breach that causes $50M to $100M+ in financial losses for the organisations downstream [1].
ISO 27001 SMB Starter Pack — $97
Threat intelligence is one thing — having the policies and controls to respond is another. Get the complete ISO 27001 starter kit for SMBs.
Get the Starter Pack →Why SMBs Are Particularly Vulnerable to This Attack Pattern
Large enterprises typically have dedicated vendor risk management teams, contracts with security clauses, and the leverage to demand SOC 2 or ISO 27001 certifications from suppliers. Most SMBs don't.
The Identity Theft Resource Center (ITRC) found that 2025 saw a record 3,322 data compromises in the United States alone [5] — an all-time high. Third-party breaches accounted for a significant portion. SMBs are often not the primary target, but they're caught in the blast radius when a shared SaaS platform, payroll provider, or communications tool is compromised.
The e-Marketing Associates 2026 cybersecurity analysis confirms the pattern: third-party breaches involving SMBs doubled in the 2025–2026 period, while regulatory scrutiny of data handling is simultaneously increasing [6]. That means the fallout — legal liability, customer notifications, regulatory fines — is larger than ever.
What Good Vendor Security Actually Looks Like
The goal here isn't to make you paranoid about using software — it's to make your vendor relationships defensible. Here's what businesses that handle this well do differently:
1. Ask vendors hard questions before signing Before you give a vendor access to your systems or customer data, ask: Do you have a SOC 2 Type 2 report? An ISO 27001 certification? A published breach response policy? If the answer is "what's that?" — that tells you something important.
2. Limit what each vendor can see Apply the principle of least privilege to your vendor relationships. A communications platform doesn't need access to your financial records. A marketing automation tool doesn't need access to your customer service tickets. Compartmentalise.
3. Include security requirements in contracts Require vendors to notify you within 24–72 hours of a breach that may affect your data. Require them to maintain cyber insurance. Make breach response obligations explicit. Many SMBs have zero security language in their vendor contracts — this is an easy win.
4. Track what you've given access to Maintain a vendor inventory: what each tool has access to, what data it holds, who in your team has accounts. When a vendor announces a breach, you need to know immediately whether you're affected. Without a list, you're guessing.
5. Enable MFA everywhere — including vendor portals The Betterment and Figure breaches both involved social engineering of human accounts. Multi-factor authentication doesn't prevent social engineering, but it adds a critical layer that slows attackers down and often forces them to abandon an attack.
6. Watch your vendor's CVE advisories Set up alerts for your key software vendors' security bulletins. When a CVE is published, patch or upgrade as fast as your vendor releases a fix. Given that 96% of CVEs are weaponised in the same year, speed matters [1].
The Real Competitive Advantage: Trust
There's an upside to getting vendor security right that's worth naming: customer trust is a genuine differentiator.
In a world where 1.4 million people just had their retirement plan data published on the internet, the businesses that can demonstrate they handle data responsibly — through auditable vendor management, contractual protections, and proactive security posture — win contracts that their competitors don't even get to bid on.
For businesses operating in healthcare, finance, legal, or government sectors, demonstrable vendor security hygiene is increasingly a procurement requirement. It's not a burden — it's a qualification.
FAQ
A third-party vendor breach happens when an attacker compromises a company you use — not your own systems directly. Because vendors often have access to your data or your customers' data, a breach at their end can expose your business even if you did nothing wrong. According to Dataminr's 2026 report, one in four breaches now occur through this attack pattern [1].
Monitor your vendors' status pages and security bulletins. Use tools like Have I Been Pwned (haveibeenpwned.com) for employee email checks. Require vendors to notify you contractually within a set timeframe if a breach occurs. For higher-risk vendors, request SOC 2 reports annually.
First, determine what data the vendor held on your behalf. Second, check whether your customer or employee data was affected. Third, follow any guidance from the vendor. Fourth, consider whether you need to notify your own customers or regulators under applicable privacy laws (Australia's Privacy Act, GDPR, etc.). Fifth, reset credentials associated with that vendor platform and audit access logs.
Yes — your vendor's cyber insurance covers their losses, not yours. Your business needs its own policy to cover costs like customer notification, regulatory fines, legal fees, and business interruption losses that arise from a vendor breach that affects your data.
lilMONSTER audits your vendor relationships, identifies which tools hold sensitive data, assesses the security posture of your top vendors, and helps you build a vendor security framework that's proportionate to your actual risk profile — without the enterprise price tag. Book a session at consult.lil.business.
References
[1] Dataminr, "2026 Cyber Threat Landscape Report," Dataminr, Feb. 2026. [Online]. Available: https://resources.dataminr.com/dataminr-for-cyber-defense/dataminr-2026-cyber-threat-landscape-report
[2] P. Arntz, "Betterment data breach might be worse than we thought," Malwarebytes, Feb. 19, 2026. [Online]. Available: https://www.malwarebytes.com/blog/news/2026/02/betterment-data-breach-might-be-worse-than-we-thought
[3] "Data breach hits 1 million Figure customers," American Banker, Feb. 19, 2026. [Online]. Available: https://www.americanbanker.com/news/data-breach-hits-1-million-figure-customers
[4] FIRST, "2026 Vulnerability Forecast," Forum of Incident Response and Security Teams, Feb. 11, 2026. [Online]. Available: https://www.first.org/blog/20260211-vulnerability-forecast-2026
[5] "ITRC: Data-Breach 'Transparency Is on Life Support'," Insurance Journal, Feb. 18, 2026. [Online]. Available: https://www.insurancejournal.com/news/national/2026/02/18/858534.htm
[6] "Cybersecurity Essentials for SMBs in 2026," e-Marketing Associates, 2026. [Online]. Available: https://www.e-marketingassociates.com/blog/cybersecurity-essentials-for-smbs-in-2026
[7] A. Jones, "Top Cyber Risks For Businesses in 2026," Anthony Jones Insurance, 2026. [Online]. Available: https://anthonyjones.com/cyber-risks-businesses-2026/
[8] A. Barker, "Report: 1 in 4 Data Breaches Exploit Third-Party Vulnerabilities," Tech.co, Feb. 19, 2026. [Online]. Available: https://tech.co/news/report-1-in-4-data-breaches-exploit-third-party-vulnerabilities
[9] "Infosecurity: FIRST Forecasts Record-Breaking 50,000+ CVEs in 2026," Infosecurity Magazine, Feb. 19, 2026. [Online]. Available: https://www.infosecurity-magazine.com/news/first-forecasts-record-50000-cve
Your vendor relationships are only as secure as the weakest link in the chain. lilMONSTER helps SMBs map that exposure and close the gaps — without enterprise complexity or cost. Book a vendor security review today.
Work With Us
Ready to strengthen your security posture?
lilMONSTER assesses your risks, builds the tools, and stays with you after the engagement ends. No clipboard-and-leave consulting.
Book a Free Consultation →The Short Version
Imagine you own a café. You've got great locks on every door. Your alarm system is top-notch. But then the company that handles your online orders gets hacked — and suddenly every customer's address and payment info is out in the open. You didn't do anything wrong. Your café was fine. But the people you trusted with your customers' details weren't.
That's what a third-party vendor breach is. And right now, 1 in every 4 data breaches happens this way [1].
Why Your Software Tools Are Now the Target
Your business probably uses dozens of software tools: a payroll system, an email platform, an accounting app, a booking system. Each one of those companies has access to some piece of your data.
When hackers want to hit a big haul — lots of businesses' data in one go — they don't try to hack every business individually. That's slow. Instead, they target one of the shared tools that thousands of businesses all use. Hit one vendor, and you've hit everyone who uses that vendor at once.
This week, a company called Betterment found this out the hard way. Hackers tricked someone at a company Betterment used for sending emails into giving them access. Then they downloaded the financial details, names, phone numbers, and retirement plan information of 1.4 million customers [2]. Betterment's own systems were fine. The problem was one of their suppliers.
A few days earlier, the same thing happened to a fintech company called Figure — 1 million customers exposed through a social engineering attack on a vendor account [3].
What "Social Engineering" Means (It's Just Fancy Trickery)
Social engineering sounds complicated. It isn't. It means convincing a human to do something by pretending to be someone they trust.
Think of it like a con artist calling your receptionist, pretending to be the IT department, and asking for a password. Your receptionist wasn't hacked. The building wasn't hacked. But someone convinced a human to open the door anyway.
Hackers use this technique because it's often easier than breaking through technical security. And once they have access to a vendor's system, they can reach your data too.
How Fast Is This Happening?
Faster than most businesses can keep up with. Here's a number that matters: 96% of vendor software vulnerabilities are turned into active attacks within the same year they are discovered [1].
That means when a flaw is found in a tool you use, there's a very good chance someone tries to exploit it quickly — often before the tool is even patched.
Security researchers are also predicting that 2026 will see over 50,000 new software vulnerabilities disclosed — a record [4]. That's a lot of doors for attackers to try.
What You Can Actually Do About It
You don't need a team of security experts. You just need a few habits:
1. Know who has your data. Write a list of every tool your business uses and what customer or business data it touches. If you don't know, you can't act fast when something goes wrong.
2. Ask vendors hard questions. Before signing up with a new tool: Do they have security certification (like SOC 2 or ISO 27001)? Do they have a breach notification policy? If they can't answer, that's a red flag.
3. Turn on two-factor authentication everywhere. Including on your vendor accounts. It doesn't stop all attacks, but it makes the con artist's job much harder.
4. Keep your vendor list small. Every new tool you add is a new door into your business. The fewer tools, the less exposure.
5. Put it in the contract. Require any vendor handling your customer data to notify you within 48 hours if something goes wrong. Many SMBs skip this — don't.
The Upside: Security as a Business Edge
Here's the thing most people miss: if you handle your vendor relationships responsibly, it becomes a selling point.
When a potential client asks "how do you protect our data?" — and you have a real answer — you win business that your competitors don't. Especially in regulated industries like healthcare, legal, or finance, where data protection is a procurement requirement.
Security isn't just defensive. Done right, it's a competitive advantage — and it saves you from having to explain to your customers why their information ended up on the internet.
Need help figuring out which vendors are your biggest exposure? That's exactly what lilMONSTER does. Book a 30-minute vendor security review →
TL;DR
- Imagine you own a café. You've got great locks on every door. Your alarm system is top-notch. But then the company that
- Your business probably uses dozens of software tools: a payroll system, an email platform, an accounting app, a booking
- Action required — see the post for details
FAQ
Q: What is the main security concern covered in this post? A:
Q: Who is affected by this? A:
Q: What should I do right now? A:
Q: Is there a workaround if I can't patch immediately? A:
Q: Where can I learn more? A:
References
[1] Dataminr, "2026 Cyber Threat Landscape Report," Dataminr, Feb. 2026. [Online]. Available: https://resources.dataminr.com/dataminr-for-cyber-defense/dataminr-2026-cyber-threat-landscape-report
[2] P. Arntz, "Betterment data breach might be worse than we thought," Malwarebytes, Feb. 19, 2026. [Online]. Available: https://www.malwarebytes.com/blog/news/2026/02/betterment-data-breach-might-be-worse-than-we-thought
[3] "Data breach hits 1 million Figure customers," American Banker, Feb. 19, 2026. [Online]. Available: https://www.americanbanker.com/news/data-breach-hits-1-million-figure-customers
[4] FIRST, "2026 Vulnerability Forecast," Forum of Incident Response and Security Teams, Feb. 11, 2026. [Online]. Available: https://www.first.org/blog/20260211-vulnerability-forecast-2026
