In October 2024, an attacker gained access to Finastra's secure file transfer platform using compromised credentials. Finastra provides financial services software to more than 8,100 financial institutions across 130 countries, including 45 of the world's top 50 banks. Between October 31 and November 8, the attacker accessed the SFTP platform multiple times and exfiltrated files containing sensitive customer data, ultimately affecting 888,627 individuals, according to breach notifications filed with US state attorneys general. The attack vector was not a sophisticated zero-day exploit. It was a set of valid credentials that let someone walk straight through the front door.
This is the defining characteristic of third-party access risk. The attacker did not break in. They logged in.
Third-party access has become the dominant breach vector in enterprise environments, and the trajectory is moving in the wrong direction. According to SecurityScorecard's 2025 Global Third-Party Breach Report, 35.5% of all breaches in 2024 were third-party related, a 6.5% increase from 2023. The Verizon 2025 Data Breach Investigations Report recorded the largest single-year shift in the report's history: third-party involvement in breaches doubled from 15% to 30% in a single year.
The financial consequences are proportional to the scale. IBM's 2025 Cost of a Data Breach Report places the average cost of a supply chain compromise at $4.91 million, running roughly 11% higher than the global average breach cost. Detection and containment takes an average of 267 days for supply chain compromises, the longest lifecycle of any breach vector IBM tracks. By comparison, the median breach in 2025 was 241 days. Attackers do not need to break the perimeter when a trusted vendor has already connected to it.
File transfer infrastructure sits at the center of this problem. SecurityScorecard found that file transfer software was the single top third-party breach enabler in 2024, accounting for 14% of all third-party breaches. The Clop ransomware group's exploitation of vulnerabilities in Cleo's file transfer software alone drove large-scale attacks across hundreds of organizations. Before that it was MOVEit. Before that it was GoAnywhere. The pattern is not a coincidence. File transfer software handles your most sensitive data and sits at the boundary between your network and the outside world. That makes it structurally attractive to anyone who wants access to what is inside.
Organizations invest heavily in securing their own perimeters. Firewalls, intrusion detection, endpoint protection, multi-factor authentication. But every vendor, partner, contractor, or service provider with legitimate access to your systems represents a path that bypasses those defenses entirely.
Research by Wiz found that 82% of companies unknowingly give third-party vendors access to all of their cloud data, and 78% of companies have third-party roles that allow for full account takeover. The average organization has 182 vendors connecting to its systems each week, according to the same research. Most of those connections were authorized at some point. Many of them are no longer actively needed. Almost none of them are being monitored in real time.
The specific failure modes that make third-party access a blind spot are well documented:
Overprivileged accounts. Vendors are granted access broad enough to perform their work at the time of onboarding and that scope rarely gets reviewed as their engagement evolves. A contractor who needed read access to one folder three years ago may still have write access across the entire environment. According to third-party access risk analysis, overprivileged and shared accounts are one of the primary factors that amplify the impact of any third-party breach.
Orphaned accounts. Projects end, contracts expire, and people move on. The accounts they used to access your systems frequently do not. A dormant credential sitting in your SFTP server is invisible until an attacker discovers it. At that point it becomes an open door with no alarm.
Unmonitored sessions. When a vendor connects to your SFTP or FTPS environment and begins downloading files, do you know about it in real time? Do you have visibility into how much data they accessed, from which IP address, and at what time? For most organizations, the answer is no. The activity is logged somewhere, but nobody is watching.
Shared credentials. A single set of login credentials shared across a vendor's team means that when one person leaves that organization, or when one device is compromised, the credential remains valid and the access remains open. Shared credentials also make forensic reconstruction nearly impossible: the audit log shows the credential was used, but not by whom.
Of all the systems that external parties access, file transfer infrastructure carries a unique combination of sensitivity and exposure. SFTP and FTPS servers are specifically designed to accept connections from external parties. That is their purpose. But that purpose creates a structural challenge: the same openness that makes them functional for legitimate partners makes them attractive to attackers who have obtained valid credentials.
The Finastra breach is instructive precisely because Finastra is a sophisticated financial technology provider with substantial security resources. The attacker did not exploit a vulnerability in the SFTP software itself. They used credentials. The security failure was not in the protocol or the encryption. It was in the governance of who had access, how that access was monitored, and how quickly anomalous behavior was detected and contained.
This is the category of risk that technical controls alone cannot address. Strong encryption protects data in transit. It does not prevent an authenticated user with valid credentials from downloading files they should not have access to. That requires a different layer of controls entirely: granular permissions that limit what each account can reach, speed limits that constrain how quickly data can leave, event handlers that flag unusual access patterns in real time, and IP restrictions that prevent credentials from being used from unexpected locations.
The organizations that manage third-party access risk effectively are not necessarily the ones with the most sophisticated security technology. They are the ones that have applied basic controls consistently across every external access point.
Least-privilege access at the folder level. A partner who needs to receive invoices should have access to the invoice directory. They should not have access to customer records, employee data, or anything else on the server. Virtual folder structures with per-account permission sets enforce this at the protocol level rather than relying on policy documents that users may not follow.
IP restriction per account. A vendor who connects from a defined set of office IP addresses should never be able to authenticate from a residential IP in another country. Whitelisting expected source addresses and blocking everything else closes the credential-theft attack vector significantly. Even if an attacker obtains valid credentials, they cannot use them from an unauthorized location.
Transfer rate limits. An account that legitimately downloads three or four files per session has no business reason to download three gigabytes in twenty minutes. Speed limits make bulk exfiltration visible by creating a detection window that does not otherwise exist. They also constrain the blast radius of any single compromised account.
Real-time event handling. When an account accesses files outside its normal pattern, at an unusual time, from an unexpected location, or in unusual volume, the system should respond automatically without requiring a human to be watching a dashboard at that exact moment. Event handlers that log, alert, or throttle based on defined conditions move detection from reactive to proactive.
Cryptographically signed audit logs. When a third-party access incident does occur, the forensic record needs to be reliable. Standard log files can be altered. Cryptographically signed logs create an immutable chain where any tampering or deletion is mathematically detectable. In a regulatory investigation or legal proceeding, that is the difference between evidence that holds up and evidence that does not.
Immediate access revocation. When a vendor relationship ends, the account should be disabled that day. Not at the next quarterly review. Not when someone gets around to it. Orphaned vendor accounts are a solved problem operationally. They require process discipline rather than technology investment.
Third-party access risk is not going to diminish as organizations become more interconnected. The number of vendor relationships is growing, the complexity of supply chains is increasing, and attackers are becoming more systematic in their targeting of trusted third parties as an entry point.
SecurityScorecard's research found that ransomware groups and state-sponsored actors are "increasingly leveraging supply chains as entry points" because of the scalability: one compromised vendor provides access to every organization that vendor serves. The Clop group's systematic exploitation of file transfer software vulnerabilities, cycling through MOVEit, GoAnywhere, Cleo, and others, reflects exactly this logic. Why attack one organization when you can attack the infrastructure that connects thousands?
The answer to this threat is not to stop working with third parties. It is to treat every external access point as a potential breach vector and manage it accordingly. The controls described above are not special so capabilities. They are standard features of purpose-built secure file transfer platforms. The gap between organizations that have a third-party access problem and organizations that do not is rarely a gap in available technology. It is a gap in whether that technology has been configured and enforced.
The Finastra breach affected 888,627 people. The attacker used valid credentials. The SFTP server accepted the connection. The controls that would have contained the damage were available. They were not in place.
