October 2026 Vendor Management News

Vendor flaws, vendor settlements, and the oversight gaps behind both. Here's what happened this month in third-party risk management news.

Recently Added Articles as of October 29

Analytics vendor breach exposes Coinbase customer contact data. Amplitude, an analytics vendor, had a security incident that exposed contact data for a small subset of Coinbase customers, along with data from other customers. Coinbase said it found no evidence its own systems were accessed and customer funds were not affected. The exchange is notifying impacted customers and regulators.

Fannie Mae adds a 36-hour cyber incident reporting window. Fannie Mae’s updated AI and cybersecurity requirements require companies to give the agency prompt details of a cyber incident within 36 hours. Companies are responsible for ensuring their third-party vendors comply. Business continuity plans must cover recovery from disruption of a third-party relationship that is material to business with Fannie Mae. The update, which takes effect on January 18, also drops the requirement to set contingencies for fourth-party vendors.

Fintech charters could reshape the bank partner business. Newly chartered fintechs and nonbanks face their real test after approval, when examiners judge how well they execute against their plans. Winning a charter and earning a good CAMELS rating on a safety and soundness exam are separate hurdles, and it’s too early to know how these entities will fare.

Tech firms behind 79% of third-party breach victims. Third-party breaches affected 69% of data breach victims between June 2025 and June 2026. In 79% of those cases, the vendor was a technology company, which is roughly 55% of all victims. Counting direct breaches too, tech-sector incidents were responsible for 60% of all victims, even though tech made up only 6% of breached organizations.. One vendor breach can reach many customers downstream.

SEC exams will target advisers’ third-party account access. Examiners will focus on advisers that use third parties to access client accounts, where existing controls may not be enough to protect client assets and data. Cybersecurity reviews will assess how firms manage the risk of increased reliance on third-party service providers and shared technologies. Regulation S-P exams will cover service provider oversight within incident response programs, and Regulation SCI exams will look at how entities manage cloud and other third-party vendor risk.

Leaked vendor key put 238,000 health plan members’ data at risk. An access key for analytics vendor SquareML sat on a publicly accessible website for more than a year before it was revoked. It potentially exposed a database holding data on 238,083 Denver Health Medical Plan members. The account was read-only, and the plan has no evidence the data was viewed or misused.

PwC says a vendor hosting employee learning records was breached. PwC said the affected site does not hold client data, sensitive personal data, or financial information. It also said its own network and operations were not affected.

Recently Added Articles as of October 22

Extortion claim targets payment vendor’s access keys. A cyber extortion group says it stole access keys and other secrets for Finzly’s payment and cloud systems and will publish them unless it’s paid. Finzly’s platform connects its bank and credit union clients to ACH, Fedwire, RTP, FedNow, and Swift through a single connection. Finzly says it’s investigating and fully operational, but hasn’t said whether credentials were taken, clients were notified, or if keys were changed.

162 Microsoft 365 tenants accessed through a backup vendor’s credential. Attackers used a compromised credential tied to ConnectWise’s Cloud Backup platform to sign in to customer Microsoft 365 tenants, with suspicious sign-ins confirmed with at least 162 organizations. The access ran through the vendor’s own application, so it needed no password and triggered no MFA prompt, and customers couldn’t have generated the credential. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management with no restoration timeline, which leaves backups and restores unavailable. A vendor application with standing access to customer tenants can bypass the customer’s own MFA.

First bank joins credit unions suing Fiserv over security. An Ohio bank became the first bank to sue Fiserv over its security, joining nine credit unions represented by the same lawyer. The suits allege Fiserv failed to provide promised multifactor authentication on systems that hold customer account data. Fiserv says stronger login protections are available on many of its systems and each client decides whether to turn them on. Courts have denied both emergency requests ruled on so far, and none of the 10 cases has been dismissed.

$2.7 million penalty after an IT vendor’s breach reached 18 client networks. New York and Connecticut secured $2.7 million from a pediatric health network and its IT management vendor, XTIUM, after a 2024 breach at XTIUM reached 18 of its clients’ networks. Investigators found the network failed to establish a security vendor assessment program or clearly define the vendor’s security responsibilities. XTIUM lacked the logging and monitoring to detect misuse of its remote support tool account and still can’t confirm how hackers got in. The network owes an additional $1.3 million if it violates the settlement terms.

Mortgage data breach settlements top $102 million since 2022. Mortgage originators, servicers, and vendors have paid more than $102 million to settle breach lawsuits since 2022. Five firms settled for over $9 million combined between June and August, led by SitusAMC at $5.3 million for more than 660,000 class members, about seven months after consumers began filing suit.

Conduent to pay $80 million over breach affecting 62 million people. Conduent agreed to pay $80 million to settle a class action over a 2024 breach that exposed personal and health data of about 62 million people. Claimants with documented fraud or identity theft losses can recover up to $3,500, and Conduent also agreed to strengthen its data security practices. The breach went undetected for almost three months.

AI tools sit in the gap in federal model risk guidance. The Fed, OCC, and FDIC’s April update to model risk guidance carves generative and agentic AI out of its formal scope, while saying broader risk management practices still cover those systems. State attorneys general are the most active AI enforcers, using consumer protection and breach notification laws already on the books. In Pennsylvania, an AI-related data exposure touching more than 500 residents requires notice to the attorney general at the same time as customer notice, plus a year of credit monitoring depending on certain triggers.

A vendor’s AI model version can stay put while its risk changes. Version numbers don’t show everything that can change at an AI vendor. The people supporting a service can gain access, authority, or a larger role without a new model release. Monitoring that tracks only version numbers misses those changes.

Same Medicaid vendor, third provider-portal breach this year. Gainwell Technologies has now had three provider-portal breaches this year, the latest exposing billing and claims data for about 3,800 Kentucky Medicaid members. In each case attackers got in through provider payment accounts on Medicaid billing portals Gainwell operates. A provider flagged the Kentucky activity roughly four months after the last confirmed access.

Recently Added Articles as of October 15

EY breach reaches wealth management clients. Notices sent at the end of September show the breach exposed data on clients of a major bank’s wealth management division, a UK-listed hedge fund, and a real estate developer. EY said earlier this year that the breach involved a vulnerability in third-party software. Between March 28 and April 12, an unauthorized third party accessed EY systems and downloaded names, addresses, tax identifiers, email addresses, and financial information. The bank said its internal systems weren’t affected and client assets remain safe.

Amex’s $350 million penalty comes with third-party risk findings. The OCC fined American Express National Bank $350 million over BSA/AML deficiencies, and the Fed’s separate order found significant deficiencies in Amex’s financial crimes program, including weaknesses in transaction monitoring, fraud referral processes, third-party risk assessment, and financial crimes risk management. Amex has 90 days to submit plans to the Fed on board oversight, its enterprise-wide BSA/AML program, and OFAC compliance. The BSA/AML plan must include risk-based oversight of network partnerships, ATM partners, and third parties engaged to support BSA/AML compliance.

Three U.S. regulators are questioning banks on advanced AI. The Federal Reserve and two other U.S. regulators are asking banks about their use of advanced AI models, according to a report from Reuters. The questions cover whether banks use technology developed in China, use AI agents for cybersecurity, and can rein in autonomous systems. That scrutiny could bring more focus on banks’ dependence on outside tech providers.

Vendor updates can switch on AI without any review. A routine cloud update can turn on AI decision-making with no purchase, contract event, or reassessment, and most SaaS agreements require notice only when a change removes functionality. Notice tied to “material change” is weak because the vendor decides what counts. Contracts should require written notice before a feature that makes decisions, generates content, or scores customer data goes live, along with documentation of the model, where it runs, and how long inputs and outputs are kept.

Recently Added Articles as of October 8

Another credit union sues Fiserv over security and exit fees. A $370 million Michigan credit union filed suit Oct. 5, alleging Fiserv failed to provide adequate cybersecurity protections across multiple systems that hold member data and that it suffered repeated outages. It says it submitted more than 160 support tickets in 2025 and more than 120 so far this year. It also alleges Fiserv would demand seven-figure early termination and deconversion fees if it tried to move its data. The suit joins a growing number of credit union lawsuits against Fiserv.

Social engineering campaign at a trading vendor exposes a digital bank's customers. A A U.K.-based bank said historic personal data, including names, email and postal addresses, phone numbers and employment information, was breached after attackers infiltrated the company that handles U.S. share trading for its customers. A sophisticated social engineering campaign gave attackers access to its network over two days in September.

FBI traces jobs portal breach to a contractor's missed patch. The contractor responsible for an FBI employee data breach has been removed after a review revealed the breach was the result of the contractor failing to apply a security patch.

Fourth-party dependencies stay invisible until something breaks. Financial institutions can generally assess direct vendors but often can't say who their critical vendors rely on or what controls those subcontractors have. Many outsourcing agreements were negotiated years ago without meaningful audit rights, incident notification requirements or exit provisions, which leaves institutions little leverage when a downstream problem surfaces. Mapping dependencies several layers deep and periodically validating vendor representations remains one of the hardest and most under-resourced parts of a resilience program.

Nearly every large bank now has responsible AI principles. All but one of 50 large global banks surveyed have AI principles in place, up from 16 in 2023. More than two-thirds also have detailed controls, including checks on what AI systems are fed and produce, limits on the tools they can use, and oversight once systems are live. AI governance talent at the banks grew 33% year over year.

Recently Added Articles as of October 1

CISA warns banks to act on actively exploited NetScaler flaws. Industry groups are urging banks to act immediately on critical Citrix NetScaler flaws that attackers are exploiting now. The flaws let attackers run commands without a valid username or password and without any user action. Banks should identify affected systems, apply Citrix's updates, and investigate whether attackers got in first, since patching doesn't remove an attacker who already has access. Banks should also contact managed IT providers, core processors, hosted application providers, and other vendors that hold bank data to find out whether they use affected products, even if the bank doesn't use NetScaler itself.

$387.5 million stolen after zero-days hit a crypto exchange's security tools. Crypto exchange Bitget said attackers exploited zero-day flaws in two third-party security products to reach its wallet environment, then planted malware on a production wallet server and a custom withdrawal tool. The theft ran for nearly three hours across multiple blockchains. Logs show the earliest malicious activity on August 31, more than three weeks before the funds moved. Outside security appliances gave attackers the foothold.

FBI jobs portal breach leaves the third-party question open. The FBI is investigating a claimed compromise of its jobs portal and said it hasn’t determined whether the breach point was a third-party provider or its own enterprise. Attackers claim they stole data on nearly all FBI agents and applicants, and a sample reviewed by 404 Media contained sensitive personal information. The group says it exploited a flaw in Oracle's PeopleSoft HR platform. The portal is offline.

Mortgage lender hack puts vendor data in play. Attackers claim to have taken data from a mortgage lender, going beyond customer data to also steal vendor data and trade secrets. The lender acknowledged a cybersecurity incident, brought in a third-party forensics team, and already faces a consumer class action.

Labcorp pays $2.3 million over its debt collector's breach. A coalition of 44 state attorneys general settled with Labcorp over a 2019 breach at its debt collection vendor that exposed data on 27.5 million people, including 10.2 million Labcorp patients. Labcorp agreed to build an incident response plan for vendor security failures, limit how much data it shares with vendors, and stand up a risk management team that tracks vendor compliance with security practices. The attorneys general said Labcorp should have done more to police the vendor.

AI creep breaks the assumptions behind periodic vendor reviews. Vendors are adding AI features without customers fully understanding the change, which undermines three assumptions behind point-in-time reviews. Those assumptions are that capabilities change slowly, that contracts will flag significant changes, and that attestations reflect the product. Risk teams need ongoing oversight and operational evidence beyond SOC reports and questionnaires. Contracts should define what counts as a material change, since incremental updates can add up to one.