[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbX9VmkAtpOGAnqcooG2-6scjTMox1dNqG_636daFMaE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"d0cc830e-e8df-4da4-a253-29a8fcc46777","compromised-iam-credentials-and-third-party-vendor-breaches-expose-customer-data-across-multiple-org","cd22a458-b790-405c-b047-063c47454af2","Compromised IAM Credentials and Third-Party Vendor Breaches Expose Customer Data Across Multiple Organizations","This weekly brief illustrates how a single weak link in the supply chain — whether a third-party vendor like Sega's unnamed partner, the Amadeus IT provider, or the Qubole data platform — can cascade into widespread customer data exposure. In the AWS case, a threat actor exploited compromised IAM credentials to pivot laterally across multiple customer environments, demonstrating how poor credential hygiene in a shared platform magnifies blast radius. Organizations are often unaware of the security posture of their technology partners until a breach occurs. This matters because customer trust, regulatory obligations, and operational continuity all depend on the security controls of vendors that organizations may have little direct visibility into.","**Immediate actions:**\n- Rotate and audit all IAM credentials for third-party integrated platforms, especially those with cross-account access to cloud environments.\n- Require third-party vendors to provide evidence of recent security assessments before maintaining active integrations.\n\n**Long-term improvements:**\n- Establish a formal third-party risk management program that evaluates vendor security controls at onboarding and annually thereafter.\n- Apply least-privilege principles to all IAM roles and service accounts used by external platforms, limiting the scope of any single compromised credential.\n- Contractually require vendors to notify you within defined timeframes of any breach affecting your data or environments.\n\n**Detection measures:**\n- Enable cloud-native anomaly detection (e.g., AWS GuardDuty) to alert on unusual IAM activity such as credential use from unexpected regions or at unusual times.\n- Aggregate and monitor logs from third-party platform integrations in your SIEM to detect lateral movement or unauthorized data access.",[12,13,14,15,16],"NIS2 Article 21(2)(d)","NIS2 Article 21(2)(i)","NIST SP 800-53 AC-6: Least Privilege","CIS Control 6: Access Control Management","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships",{"NIS2 Article 21(2)(d)":18,"NIS2 Article 21(2)(i)":19,"NIST SP 800-53 AC-6: Least Privilege":20,"CIS Control 6: Access Control Management":21,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":22},"This incident directly involves security failures in supply chain relationships — third-party vendors (Amadeus, Qubole, Sega's partner) were the entry points for breaches affecting the primary organizations.","The AWS compromise via Qubole stemmed from compromised IAM credentials, which falls squarely under the access control and asset management obligations this point requires.","If IAM roles granted to Qubole had been scoped to minimum necessary permissions, the attacker's ability to access multiple customer AWS environments would have been significantly limited.","This control requires managing credentials and access rights for all users and service accounts, which would have prevented the reuse of compromised IAM credentials across customer environments.","This control requires organizations to define and implement processes to manage information security risks associated with suppliers, which would have surfaced the security weaknesses at Amadeus, Qubole, and Sega's vendor.","published","2026-11-13T11:21:34.539863+00:00","2026-11-13T11:21:34.52+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.cert.se\u002F2026\u002F11\u002Fncsc-cert-se-veckobrev-v46.html","ncsc-cert-se-veckobrev-v-46-8d4dec","NCSC – CERT-SE veckobrev v.46",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":50,"name":51,"problem":52},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",{"slug":54,"name":55,"problem":56},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]