Breach at an IT vendor serving thousands of US hospitals: your biggest cyber risk is someone else's infrastructure

Hackers stole what investigators describe as a "significant amount of data" from a technology company whose services are used by thousands of hospitals and pharmacies across the US. It's a classic supply-chain attack: the medical organizations themselves did nothing wrong, yet their data leaked along with the breach of a shared vendor.

This class of attack is growing faster than others because it pays: one compromised contractor opens doors into hundreds of organizations at once. Victims, meanwhile, often have neither contracts assigning incident liability nor even a complete list of which external services can reach their systems.

For a company in Kazakhstan, the practical checklist is short. First, list every contractor and service with access to your data — from cloud accounting to the SMS gateway. Second, for each one, understand what leaks if they're breached and how you would find out. Third, put incident notification duties into contracts. It's a dull couple of days of work — but it's exactly what separates companies that ride out someone else's breach calmly from those that learn about it from the news.