A data theft campaign running for months continued targeting widely adopted corporate platforms, with new targets identified in the second week of August.
The logic is economic before it is technical. Attacking each company separately requires repeated effort; compromising a platform used by many yields access to several environments for the same work.
That relocates responsibility uncomfortably. A company's security posture starts depending on what its suppliers do, in an arrangement where it has neither visibility nor control, and frequently not even a complete inventory of active integrations.
The period accumulated examples of the same pattern, including an incident at a healthcare software supplier with thousands of clients and an attack that reached an industrial production environment.
The available defence is unglamorous and effective: review what each integration can see, remove connections nobody uses, reduce the scope of tokens granted to applications, and require notification deadlines in contracts.