Some breaches are just bad days. A few rewrite the rules for everyone, whether or not you were involved. Over the last decade a handful of them permanently changed how I — and every honest IT leader — have to think about risk. The common thread is uncomfortable: the ground kept shifting from "did you get your security right?" to "did a supplier you'd never audited get theirs right?"

1. Equifax and the unpatched hole (2017)

In 2017, Equifax exposed the personal data of roughly 147 million Americans — names, Social Security numbers, birth dates, the full identity-theft starter kit. What made it a permanent teaching case wasn't the size; it was the cause. The way in was a known vulnerability in Apache Struts for which a patch had been available for two months. A patch nobody applied to the right server.

Equifax turned patch management from an IT-hygiene chore into a board-level accountability question. After it, "we didn't get around to that patch" stopped being an operational footnote and became the kind of sentence that ends careers and triggers regulators.

2. SolarWinds and the supply-chain turn (2020)

Then the rules changed more fundamentally. In December 2020 the SolarWinds compromise came to light: attackers had breached the build system for a widely-used network-management product and pushed malicious code inside a legitimate signed update to something like 18,000 customer organisations. They'd been inside since roughly September 2019 — over a year undetected. Government agencies and major enterprises were compromised not through their own mistakes but through software they had every reason to trust.

SolarWinds broke a comfortable assumption I'd relied on for years: that a signed update from a reputable vendor was safe to install. After it, "trusted vendor" stopped being a security control.

3. Log4Shell: the dependency you didn't know you had (2021)

December 2021 brought Log4Shell, a flaw in a tiny, ubiquitous Java logging library called Log4j. CISA's director called it the most serious vulnerability she'd seen in her career, and mass exploitation began within days of the public proof-of-concept. The terror of Log4Shell was that almost nobody could immediately answer the only question that mattered: do we even use this, and where? It was buried three dependencies deep in software people had bought, not built.

That was the moment "software bill of materials" stopped being a compliance phrase and became something I genuinely wanted for every system I ran. You cannot patch what you don't know you're running.

4. MOVEit and the shared platform (2023)

In 2023 the MOVEit campaign completed the pattern. A crew exploited a zero-day in a popular managed file-transfer product and, through that one piece of shared software, reached the data of hundreds of organisations — governments, universities, businesses — that had no direct relationship with the attacker and no way to have prevented it themselves. The victim list read like a phone book, and almost none of them had been individually targeted.

5. The pattern that changed everything

Line these up and the trajectory is unmistakable. Equifax was a failure inside your own walls. SolarWinds, Log4Shell and MOVEit were failures inside walls you don't own and can't inspect — your vendors, your dependencies, your shared platforms. The centre of gravity of risk moved from "secure your estate" to "you are only as secure as a supply chain you mostly can't see." For anyone who thinks in the ISACA risk language, this is third-party and concentration risk becoming the main event rather than a footnote.

6. What I changed because of them

These breaches rewired how I run security, concretely:

  • Vendor risk moved to the front. Who are my critical suppliers, what would their compromise do to me, and can I answer that before an incident rather than during one.
  • Know what you run. An inventory of software and its major dependencies, so that the next Log4Shell is a search query, not a two-week panic.
  • Assume breach. Design so that a compromised vendor or credential is contained — segmentation, least privilege, monitoring — rather than trusting the perimeter to hold.
  • Evidence, not assurances. The audit discipline that lets me prove, to a regulator or a board, that these controls actually operate.

None of this makes you invulnerable to a supplier's mistake. It makes you survivable, and defensible, when one happens — which, this decade taught us, it eventually will. If your third-party risk picture is fuzzier than you'd like, let's talk it through.