#vendor-security — Public Fediverse posts

Third-party breach, 38M impacted, European e-commerce sector.
ManoMano disclosed unauthorized access linked to a subcontracted customer support provider. Exposed data reportedly includes PII and support communications.
Authorities notified: CNIL, ANSSI.
Passwords not reportedly accessed.
Subcontractor access revoked.

Key risk vectors:
– SaaS support platforms
– Vendor access governance
– Over-retention of ticketing data
– Centralized customer communication logs
– Supply chain attack surface expansion

This case reinforces that vendor monitoring must go beyond contractual clauses — continuous assessment, least privilege enforcement, data minimization strategies.

How mature is your third-party risk telemetry?
Engage below.

Source: https://www.bleepingcomputer.com/news/security/european-dyi-chain-manomano-data-breach-impacts-38-million-customers/

Follow @technadu for high-signal infosec reporting.

Repost to amplify awareness across the security community.

#Infosec #ThirdPartyRisk #VendorSecurity #SupplyChainSecurity #DataBreach #GDPRCompliance #EcommerceSecurity #CyberRiskManagement #SecurityOperations #GRC

OpenAI has reported that a breach at Mixpanel exposed limited API-user metadata, including names, emails, coarse location, OS/browser details and IDs.

This was not an OpenAI breach, and no chat content, credentials, API keys or payment data were exposed.

The incident resulted from a smishing compromise of Mixpanel’s environment.

OpenAI has fully removed Mixpanel and is conducting wider vendor audits.
How concerned should teams be about metadata exposure at third-party analytics providers?

Full Article: https://www.technadu.com/mixpanel-breach-exposes-limited-openai-api-user-analytics-data/614756/

Follow us for more security coverage.
#infosec #OpenAI #Mixpanel #databreach #smishing #securityincident #MFA #vendorsecurity #securitynews

OpenAI confirmed that limited API-user data was exposed through a breach at its previous analytics provider, Mixpanel. The dataset included names, emails, coarse location, user/organization IDs, and technical metadata — but no chats, passwords, API keys, or payment data.

Researchers noted that sending identifiable data to analytics tools isn’t aligned with typical security best practices.

What’s your view on data minimization in analytics pipelines?

Source: https://cybernews.com/security/openai-mixpanel-cybersecurity-incident-breach/

Share your thoughts - and follow us for more updates.

#InfoSec #CyberSecurity #DataPrivacy #OpenAI #Mixpanel #APISecurity #DataBreach #VendorSecurity #ThreatIntel #SecurityEngineering #TechNews

Third-Party Risk is a Top Threat in 2025—Are You Ready? From breaches to AI-driven vendor risks, third-party risk is evolving fast. Learn how to secure your vendor ecosystem & reduce risk. Watch now! https://youtu.be/HV-Ysn6-ZxQ

#Cybersecurity #TPRM #VendorSecurity #AI #RiskManagement #CISO

@JayeLTee Take a look at this -- Khalil Center really responded quickly to responsible disclosure:

https://databreaches.net/2025/01/03/khalil-centers-impressively-rapid-incident-response/

#dataleak #ransom #incidentresponse #HIPAA #disclsoure #businessassociate #vendorsecurity