From a lending platform outage to leaked payment firewall keys, vendor incidents keep testing how financial institutions oversee their third parties. Catch up on this month’s TPRM news below.
Recently Added Articles as of November 5
Fintech software provider offline for 3 days after a security incident. A fintech service provider for banks and credit unions was taken offline after a data security incident. Most of the platform returned Monday, but borrower-facing tools stayed down and the incident was still unresolved Tuesday. It's unknown if data was taken.
Leaked payment vendor files include firewall keys and a map of its Fed connection. An extortion group published passwords and keys to the firewall guarding Finzly’s connection to the Federal Reserve, along with details of how it’s configured. Finzly says it rotated system keys and credentials and that the files alone can’t give anyone access. The Fed said its payment services weren’t affected.
Prediction market halts trading after a vendor compromise. Polymarket paused trading on its international platform for about an hour after a third-party provider was compromised, then resumed and promised to fully reimburse affected traders. Reports tie the incident to DebugBear, a UK website performance monitoring company that told clients using one of its products to remove the embed code from their sites.
Blockchain analytics provider warns customers after an AI-driven intrusion. Chainalysis said an outside actor used “offensive agentic techniques” to get into internal systems and tools. The data accessed was non-sensitive, including user IDs, full names, email addresses, and organization role labels. Chainalysis has no evidence that investigation content, clear-text passwords, MFA secrets, or session tokens were accessed. It told customers to watch for unexpected password reset requests and to enable two-factor authentication if they haven’t.
Bank trade groups ask regulators for more time on third-party risk guidance. ABA, ICBA, and other industry trade groups requested 30-day extensions on the proposed revisions to the interagency third-party risk management guidance and the Federal Reserve’s separate proposed guide for community banks. They said early feedback from bankers at institutions of all sizes raised points that need more discussion and analysis before formal comments are filed.
