Black Kite’s annual Third-Party Breach Report was released for 2022. The report examines the impact of third-party cyber breaches. The level of breach impact doubled in 2022 with 4.73 affected companies per vendor compared to 2.46 companies per vendor in 2021. With 63 third-party breaches analyzed and 298 publicly disclosed victims last year, the magnitude of attack continues to increase, putting organizations at heightened risk in 2023.

The report’s key findings include:

• Unauthorized network access was the most common root cause of third-party attacks, initiating 40% of the third-party breaches last year.
• Ransomware accounted for 27% of third-party breaches in 2022 — a decrease from 2021.
• The average time between an attack and the disclosure date was 108 days, with a 50% increase from 2021 — giving threat actors more time to cause significant damage with stolen data.
• Technical services vendors (providing infrastructure services) were the top target of third-party breaches. In the top three for a fourth consecutive year, these vendors were included in 30% of incidents.
• The healthcare industry was the most common victim of third-party breaches accounting for 34% of incidents 2022 — an increase from 2021 — followed by finance (14%) and government (14%).