For years, the cybersecurity playbook centered on hardening the perimeter: better firewalls, stronger endpoint protection, tighter access controls on the primary network. That strategy worked well enough that attackers have simply changed their approach.
Rather than spending time and resources trying to break through increasingly fortified primary defenses, threat actors are now targeting the softer, less visible layer surrounding every organization — its vendors, its Managed Service Providers (MSPs), and the SaaS platforms it depends on to run day-to-day operations.
This shift isn’t theoretical. It’s playing out in real breach notices, real regulatory filings, and real financial losses across every sector, but healthcare has become one of the starkest examples of what’s at stake.
A Case Study in Real-World Impact: NYC Health + Hospitals
n early 2026, New York City Health and Hospitals Corporation — the largest municipal healthcare network in the United States — disclosed that an unauthorized actor had been inside its systems for roughly eleven weeks, from late November 2025 until February 2026, before being detected. By the time the investigation concluded, the breach was confirmed to affect approximately 1.8 million current and former patients and employees, exposing medical records, insurance details, Social Security numbers, financial account information, and — notably — biometric data including fingerprints and palm prints.
What makes this incident so instructive isn’t the scale alone. It’s the point of entry. NYC Health + Hospitals has stated that the intrusion appears to have originated through a security breach at one of its third-party vendors, not through a direct assault on its own network. The organization’s own perimeter defenses were never breached in the traditional sense. Instead, attackers used a trusted vendor relationship as a legitimate-looking doorway into the network, bypassing the very controls designed to keep outsiders out.
This wasn’t an isolated event either. A separate breach earlier in 2025 involving NADAP, a care management partner connected to NYC Health + Hospitals, exposed records for roughly 5,000 patients — a smaller incident, but one that reinforces the same pattern: attackers are systematically probing the periphery of large organizations rather than the core.
Why This Attack Vector Is So Effective
A handful of structural realities make vendor and supply-chain compromise an especially attractive target for attackers:
- Trust is the vulnerability. Vendor credentials are often granted broad, standing access to make integration and support easier. Once compromised, that access looks like normal, authorized activity to most monitoring tools.
- Vendors are frequently under-resourced. Smaller partners, contractors, and regional service providers often lack the security budgets and staffing of the enterprises they serve, making them comparatively soft targets that still provide a path to high-value data.
- Visibility gaps are built in. When a function is outsourced — billing, IT support, care coordination, staffing — the data and access associated with it often flow outside the primary organization’s direct line of sight, creating blind spots in continuous monitoring.
- Disclosure requirements are limited. Organizations are generally not required to name the compromised vendor in breach notifications, which can obscure the full scope of exposure across an industry and slow collective response.
- Dwell time is longer. Because vendor access is inherently trusted, intrusions through this channel tend to go undetected longer than direct attacks on primary systems, giving attackers more time to move laterally and exfiltrate data.
How Organizations Are Responding
In the wake of incidents like this, security teams and leadership are converging on a few concrete defensive priorities:
Network micro-segmentation for third-party access. Rather than granting vendors broad network access, organizations are increasingly isolating third-party connections into tightly scoped segments, limiting what any single compromised credential can reach.
Federated identity audits. Regular review of federated identity relationships — who has access, why, and whether that access still matches an active business need — is becoming a standing requirement rather than an annual checkbox exercise.
Behavioral monitoring on vendor sessions. Because vendor access looks legitimate by default, organizations are applying dedicated behavioral analytics to third-party sessions specifically, watching for anomalies in timing, data volume, and access patterns that would otherwise blend into normal traffic.
Formal Vendor Risk Management (VRM) programs. Security and compliance teams are building out structured inventories of which vendors have access to what systems and data, tying that inventory to ongoing risk assessments rather than one-time onboarding reviews.
Faster detection-to-response cycles. Given that perimeter defenses may never be tested in a vendor-originated attack, the emphasis is shifting toward how quickly an intrusion can be detected and contained once it’s inside, rather than relying solely on prevention.
The Bigger Picture
The NYC Health + Hospitals breach is a clear illustration of a broader trend: an organization’s security posture is only as strong as the least-defended partner in its ecosystem. As businesses continue to rely on interconnected vendors, MSPs, and SaaS integrations to operate efficiently, the attack surface extends well beyond what any single perimeter can protect.
For security leaders, the takeaway is straightforward — third-party risk management can no longer be treated as a procurement formality or an annual compliance checkbox. It needs to be treated with the same rigor, monitoring, and urgency as any other core piece of the security program.
This article references publicly reported details of the NYC Health + Hospitals data breach disclosed in 2026. The identity of the third-party vendor involved has not been publicly disclosed, and the investigation into the incident remains ongoing.
~Rushen Wickramaratne