What's Happening?
A recent study co-authored by KPMG indicates that 45% of data breaches affecting 250 leading U.S. energy companies were attributable to third-party vendors. This figure significantly surpasses the global average of 29%. The study, conducted in 2024, highlights
that two-thirds of these third-party breaches involved providers of software and IT products and services. A substantial portion, over one-third, originated from a single widespread campaign: the 2023 exploitation of a vulnerability in Progress Software’s MOVEit file-transfer software. Notably, four of these incidents were classified as fourth-party breaches, meaning they stemmed from vulnerabilities in the vendors' own MOVEit installations. This situation underscores a critical challenge in traditional vendor assessment methods, which often fail to identify such shared dependencies and concentration risks within the supply chain.
Why It's Important?
The prevalence of third-party cyber breaches in the U.S. energy sector carries significant implications for national security, economic stability, and critical infrastructure. Energy companies are vital to the functioning of the U.S. economy, and disruptions due to cyberattacks can have cascading effects across various sectors. The study reveals that traditional, periodic vendor assessments are insufficient in today's rapidly evolving threat landscape, where ransomware campaigns, supply chain compromises, and advanced attack techniques can alter a vendor's risk profile within days. This necessitates a shift towards continuous, intelligence-driven third-party cyber risk management (TPCRM) to protect operational continuity, energy delivery, and regulatory compliance. Failure to adapt could lead to increased financial losses, operational downtime, and potential safety hazards, impacting both companies and consumers.
What's Next?
The findings suggest that U.S. energy companies must transition from static, questionnaire-based vendor assessments to continuous monitoring and contextual risk prioritization. This involves incorporating objective telemetry, such as external attack surface exposure, known exploited vulnerabilities, and credential leaks, to provide evidence-based and continuously observable risk data. The National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA) already advocate for continuous monitoring for federal agencies, a practice that private energy companies are urged to adopt. Furthermore, TPCRM needs to be integrated across various functions, including security operations, incident response, governance, risk, and compliance, procurement, and legal departments, to ensure that critical intelligence reaches decision-makers promptly and effectively.
Beyond the Headlines
The increasing reliance on third-party software and IT services creates a complex web of interconnected vulnerabilities, where a single point of failure can compromise multiple entities. This raises ethical and legal questions regarding accountability and responsibility when breaches occur through a vendor's vendor (fourth-party risk). The study implicitly highlights the need for more robust contractual agreements with vendors that mandate stringent security controls and continuous monitoring. Culturally, there needs to be a shift from viewing cybersecurity as a compliance checklist to an ongoing, dynamic risk management process. The long-term implication is a potential re-evaluation of supply chain resilience strategies within critical U.S. industries, pushing for greater transparency and shared responsibility in managing cyber risks across the entire ecosystem.
