The incident at a healthcare financial software supplier, with a platform used by thousands of hospitals and clinics, illustrates a risk that rarely appears in any single organisation's risk assessment.
Each hospital assesses its own systems, its own network and its own staff. What usually goes missing is that much of the operation depends on a supplier shared with thousands of competitors, and that supplier's security posture isn't auditable from outside.
The attacker's logic is economic before it is technical. Compromising one organisation yields one organisation; compromising a supplier used by thousands yields access to many for the same effort.
The pattern repeated through the year across distinct incidents, hitting widely adopted corporate platforms and reaching an industrial production environment, halting a plant.
The available defence is less glamorous than the tooling conversation: reduce what each integration can see, review permissions granted to connected applications, remove unused connections, and require notification deadlines in contracts.