Huge “Shadow Layer” of Organizations Hit by Supply Chain Attacks

Black Kite's 2025 Third‑Party Breach Report finds 136 verified vendor breaches affecting 719 companies and 433 million individual customers (with many more unreported victims), concentrated in software services and downstream sectors like healthcare, education and financial services; the report highlights median detection of 10 days and median notification of 73 days, widespread critical vulnerabilities and exposed credentials among top vendors, and warns that traditional third‑party risk management is failing, creating a systemic supply‑chain risk.