Full Report
Orange Cyberdefense found that over half of UK financial firms suffered at least one third-party attack in 2024, linked to significant gaps in risk management strategies
Analysis Summary
# Incident Report: Widespread Third-Party Supply Chain Attacks on UK Finance Sector
## Executive Summary
A significant number (58%) of large UK financial services firms experienced at least one third-party supply chain attack during 2024, highlighting severe gaps in continuous Third-Party Risk Management (TPRM). Firms relying solely on initial onboarding risk assessments were significantly more likely to be compromised. The reported incidents underscore a growing trend where vendor vulnerabilities lead directly to breaches within critical financial infrastructure.
## Incident Details
- Discovery Date: Data collected throughout 2024 (Report published Feb 2025)
- Incident Date: Throughout 2024
- Affected Organization: Large UK financial services firms (Multiple victims implied)
- Sector: Finance
- Geography: UK
## Timeline of Events
### Initial Access
- Date/Time: Throughout 2024 (ongoing risk vector)
- Vector: Compromise of third-party suppliers and vendors (Supply Chain Attack).
- Details: Attackers exploited poorly managed security posture within the supply chain to reach the primary financial institutions.
### Lateral Movement
- Details: Not explicitly detailed, but implied to occur after initial access via a trusted third-party channel.
### Data Exfiltration/Impact
- Details: The outcome of the attacks is a confirmed compromise, though specific data types or loss volume is not detailed beyond the occurrence of the attack itself.
### Detection & Response
- Details: The prevalence of attacks suggests detection was reactive, often following the success of the supply chain exploit, rather than proactive vulnerability management. Risk assessment practices (only 14% use continuous monitoring) indicate insufficient detection focused on the supply chain perimeter.
## Attack Methodology
This report focuses on the underlying systemic weakness leading to attacks, rather than a single TTP chain:
- Initial Access: Exploitation of weak controls within a third-party supplier.
- Persistence: Not detailed.
- Privilege Escalation: Not detailed.
- Defense Evasion: Relied on the inherent "trust" granted to a third-party vendor endpoint.
- Credential Access: Not detailed.
- Discovery: Attackers likely leveraged existing access for further internal reconnaissance.
- Lateral Movement: Movement from the compromised third-party into the primary financial organization's network.
- Collection: Not detailed.
- Exfiltration: Implied as the final action of the successful supply chain compromise.
- Impact: Successful infiltration and compromise of the targeted firm via a trusted path.
## Impact Assessment
- Financial: Not quantified, but significant costs implied due to the high volume (58% affected) and reactive nature of response.
- Data Breach: Confirmed data/system compromise occurred via third-party ingress. Specific data types are not detailed.
- Operational: Operational resilience risks increased due to reliance on unverified third parties.
- Reputational: Not explicitly detailed, but implied reputational damage associated with supply chain compromises in the regulated finance sector.
## Indicators of Compromise
As this report aggregates statistics rather than detailing a single event, technical IoCs are not provided.
## Response Actions
Since the report focuses on *why* security failed rather than the specific recovery from one incident, response actions reflect remediation of systemic weaknesses:
- Containment: Implied containment efforts following the recognition of supply chain compromises.
- Eradication: Implied necessary work to sever connections with compromised vendors.
- Recovery: Not detailed.
## Lessons Learned
- **Inadequate Risk Cadence:** Relying primarily on onboarding assessments (44% do this) is insufficient, as risk changes over time.
- **Lack of Continuous Monitoring:** Only 14% of firms use dedicated TPRM tools for continuous assessment, directly correlating to higher attack rates (68% attack rate for those only assessing at onboarding).
- **Regulatory Divergence Concern:** Surveyed CISOs express concern over UK regulatory alignment lagging behind robust EU frameworks (like NIS2 and DORA), suggesting current UK regulation may be less proactive.
## Recommendations
- Implement continuous, technology-driven Third-Party Risk Management (TPRM) practices for all critical suppliers, moving beyond static, point-in-time assessments.
- Review and align UK cybersecurity regulations and internal resilience standards closer to established EU frameworks (like DORA) to ensure comprehensive digital operational resilience.
- Mandate robust security controls and continuous monitoring shared visibility agreements for all high-risk third-party vendors.