The common thread across these three incidents is that the breach perimeter is no longer the organization's own network. In each case, the harm traveled through a trusted intermediary: a third-party provider holding client data, an internal secrets store reached through unauthorized access, or a remote-access tool already trusted inside customer environments. For US technology companies and the consumers whose data they hold, the operative question has shifted from what an organization secures itself to what it inherits from everyone it depends on.
The Breach Arrives Through the Vendor Door
The Baker Tilly Advisory Group is notifying clients that a data breach at a third-party provider compromised certain personal information about them and their dependents, as BleepingComputer reported. The detail that matters is not the firm named in the notice but the entity behind it. The affected data subjects are clients and their dependents, people who likely never had a direct relationship with the provider that was breached. Their personal information sat with an intermediary, and the notice traveled back up the chain. This is the ordinary shape of a modern breach notification: the organization that sends the letter is often not the organization whose defenses failed.
For US consumers, that means breach notices increasingly arrive from a company they recognize for an incident that happened somewhere they have never heard of. For US technology companies, it means the duty of care extends to every vendor that touches personal data, including the dependents of clients, a category that carries its own sensitivity and its own notification obligations.
Credentials Are the Asset Under Attack
Apify rotated critical internal secrets and revoked some third-party OAuth connections after detecting unauthorized access to its internal systems, as BleepingComputer reported. The response is the story here. Rotating secrets and revoking OAuth connections are the actions of an organization that understands its internal systems are bound to external services through tokens and delegated access. When an intruder reaches that layer, the blast radius is not confined to the compromised system; it extends to every service those credentials could reach.
This is the same logic that makes the ScreenConnect campaign effective. The internal secrets and OAuth grants that Apify had to revoke are exactly the kind of trust relationships that attackers seek out, because they convert a single point of access into a broad set of permissions. The breach is not one system falling; it is a set of standing permissions being used by someone else.
The Tool Already Inside the Walls
ConnectWise is investigating an active malware campaign targeting managed service providers that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices, as BleepingComputer reported. ScreenConnect is a legitimate remote-support product. That is precisely what makes the campaign work: the malicious activity runs through infrastructure that customers already permit to reach their devices. The MSP is the intermediary, and the remote-access tool is the trusted channel.
The impact reaches dozens of organizations, according to the reporting. The pattern is consistent with the other two stories. The attacker did not need to defeat each downstream customer individually; the path ran through a provider whose access was already established. For US technology companies that rely on MSPs for IT and support functions, the practical implication is that the security posture of the service provider is part of their own posture, whether or not procurement treats it that way.
