A large convenience store chain sent breach notices in early May after unauthorised access to franchisee document systems. The group responsible claimed over 600,000 records taken from a corporate management platform and released a 9.4 gigabyte archive.
The chosen target, franchisee document systems, describes well where sensitive data tends to be forgotten. It isn't the main database or the payment system: it's the administrative repository, holding contracts, personal documents and financial information for hundreds of small business owners.
That kind of system usually has looser controls precisely because it isn't seen as operationally critical. Nobody stops selling if it goes down, so it falls off the security priority list.
The campaign that hit this chain followed the same pattern as other cases in the year, targeting widely adopted corporate platforms, because compromising one point yields access to many environments at once.
The practical question the case leaves for any operation with a partner network: where are your partners' documents stored, who has access, and how long since anyone reviewed it.