Vendor flaws, vendor settlements, and the oversight gaps behind both. Here's what happened this month in third-party risk management news.
Recently Added Articles as of October 15
EY breach reaches wealth management clients. Notices sent at the end of September show the breach exposed data on clients of a major bank’s wealth management division, a UK-listed hedge fund, and a real estate developer. EY said earlier this year that the breach involved a vulnerability in third-party software. Between March 28 and April 12, an unauthorized third party accessed EY systems and downloaded names, addresses, tax identifiers, email addresses, and financial information. The bank said its internal systems weren’t affected and client assets remain safe.
Amex’s $350 million penalty comes with third-party risk findings. The OCC fined American Express National Bank $350 million over BSA/AML deficiencies, and the Fed’s separate order found significant deficiencies in Amex’s financial crimes program, including weaknesses in transaction monitoring, fraud referral processes, third-party risk assessment, and financial crimes risk management. Amex has 90 days to submit plans to the Fed on board oversight, its enterprise-wide BSA/AML program, and OFAC compliance. The BSA/AML plan must include risk-based oversight of network partnerships, ATM partners, and third parties engaged to support BSA/AML compliance.
Three U.S. regulators are questioning banks on advanced AI. The Federal Reserve and two other U.S. regulators are asking banks about their use of advanced AI models, according to a report from Reuters. The questions cover whether banks use technology developed in China, use AI agents for cybersecurity, and can rein in autonomous systems. That scrutiny could bring more focus on banks’ dependence on outside tech providers.
Vendor updates can switch on AI without any review. A routine cloud update can turn on AI decision-making with no purchase, contract event, or reassessment, and most SaaS agreements require notice only when a change removes functionality. Notice tied to “material change” is weak because the vendor decides what counts. Contracts should require written notice before a feature that makes decisions, generates content, or scores customer data goes live, along with documentation of the model, where it runs, and how long inputs and outputs are kept.
Recently Added Articles as of October 8
Another credit union sues Fiserv over security and exit fees. A $370 million Michigan credit union filed suit Oct. 5, alleging Fiserv failed to provide adequate cybersecurity protections across multiple systems that hold member data and that it suffered repeated outages. It says it submitted more than 160 support tickets in 2025 and more than 120 so far this year. It also alleges Fiserv would demand seven-figure early termination and deconversion fees if it tried to move its data. The suit joins a growing number of credit union lawsuits against Fiserv.
Social engineering campaign at a trading vendor exposes a digital bank's customers. A A U.K.-based bank said historic personal data, including names, email and postal addresses, phone numbers and employment information, was breached after attackers infiltrated the company that handles U.S. share trading for its customers. A sophisticated social engineering campaign gave attackers access to its network over two days in September.
FBI traces jobs portal breach to a contractor's missed patch. The contractor responsible for an FBI employee data breach has been removed after a review revealed the breach was the result of the contractor failing to apply a security patch.
Fourth-party dependencies stay invisible until something breaks. Financial institutions can generally assess direct vendors but often can't say who their critical vendors rely on or what controls those subcontractors have. Many outsourcing agreements were negotiated years ago without meaningful audit rights, incident notification requirements or exit provisions, which leaves institutions little leverage when a downstream problem surfaces. Mapping dependencies several layers deep and periodically validating vendor representations remains one of the hardest and most under-resourced parts of a resilience program.
Nearly every large bank now has responsible AI principles. All but one of 50 large global banks surveyed have AI principles in place, up from 16 in 2023. More than two-thirds also have detailed controls, including checks on what AI systems are fed and produce, limits on the tools they can use, and oversight once systems are live. AI governance talent at the banks grew 33% year over year.
Recently Added Articles as of October 1
CISA warns banks to act on actively exploited NetScaler flaws. Industry groups are urging banks to act immediately on critical Citrix NetScaler flaws that attackers are exploiting now. The flaws let attackers run commands without a valid username or password and without any user action. Banks should identify affected systems, apply Citrix's updates, and investigate whether attackers got in first, since patching doesn't remove an attacker who already has access. Banks should also contact managed IT providers, core processors, hosted application providers, and other vendors that hold bank data to find out whether they use affected products, even if the bank doesn't use NetScaler itself.
$387.5 million stolen after zero-days hit a crypto exchange's security tools. Crypto exchange Bitget said attackers exploited zero-day flaws in two third-party security products to reach its wallet environment, then planted malware on a production wallet server and a custom withdrawal tool. The theft ran for nearly three hours across multiple blockchains. Logs show the earliest malicious activity on August 31, more than three weeks before the funds moved. Outside security appliances gave attackers the foothold.
FBI jobs portal breach leaves the third-party question open. The FBI is investigating a claimed compromise of its jobs portal and said it hasn’t determined whether the breach point was a third-party provider or its own enterprise. Attackers claim they stole data on nearly all FBI agents and applicants, and a sample reviewed by 404 Media contained sensitive personal information. The group says it exploited a flaw in Oracle's PeopleSoft HR platform. The portal is offline.
Mortgage lender hack puts vendor data in play. Attackers claim to have taken data from a mortgage lender, going beyond customer data to also steal vendor data and trade secrets. The lender acknowledged a cybersecurity incident, brought in a third-party forensics team, and already faces a consumer class action.
Labcorp pays $2.3 million over its debt collector's breach. A coalition of 44 state attorneys general settled with Labcorp over a 2019 breach at its debt collection vendor that exposed data on 27.5 million people, including 10.2 million Labcorp patients. Labcorp agreed to build an incident response plan for vendor security failures, limit how much data it shares with vendors, and stand up a risk management team that tracks vendor compliance with security practices. The attorneys general said Labcorp should have done more to police the vendor.
AI creep breaks the assumptions behind periodic vendor reviews. Vendors are adding AI features without customers fully understanding the change, which undermines three assumptions behind point-in-time reviews. Those assumptions are that capabilities change slowly, that contracts will flag significant changes, and that attestations reflect the product. Risk teams need ongoing oversight and operational evidence beyond SOC reports and questionnaires. Contracts should define what counts as a material change, since incremental updates can add up to one.
