When Your Vendor Is the Vulnerability

Anatomy of a 2025 SaaS Breach

The typical breach seen in 2025 follows a clear, repeatable pattern—one that NHS leaders can no longer afford to ignore:

1. Initial Access
   Exploiting social engineering, attackers impersonate legitimate users or partners to convince a SaaS vendor’s helpdesk to reset credentials or disable MFA. These workflows—optimised for speed, not verification—often bypass even robust identity controls.
2. Over-Permissioned Integrations
   With access obtained, attackers escalate privileges using over-scoped API tokens or CRM OAuth grants. These tokens typically span multiple systems, thanks to sprawling SaaS ecosystems (e.g., CRM platforms tied to HR, payroll, and messaging).
3. Lateral Movement
   Next, attackers pivot laterally, often moving from one SaaS platform to another. They extract sensitive data, inject malicious payloads, or hijack message delivery services—effectively impersonating the organisation.
4. Extortion and Disruption
   Finally, they exfiltrate data, trigger encryption, or threaten disclosure—disrupting operations and triggering a crisis response. In internal comms terms, this can mean messages misdelivered, delayed, spoofed or blocked—damaging trust at the worst possible time.

A notable example comes from the Marks & Spencer ransomware attack, where a compromised IT contractor’s helpdesk workflow created a critical vulnerability. Communications outages affected rota messaging and staff coordination at peak periods.

In another 2025 case, attackers breached Workday via compromised Salesforce OAuth apps, exposing sensitive HR and payroll data. Harrods faced data loss after attackers accessed customer information through a marketing vendor. Though core systems remained intact, internal communications channels were disrupted and regulatory action followed.

Why This Matters for NHS Internal Comms

For NHS organisations, a compromised communication platform does not just mean a delay in emails. It can mean missed emergency alerts, undermined transformation initiatives, and serious breaches of information governance standards.

NHS leaders must now consider vendor risk as a core element of communications strategy. Communications systems are lifelines in health settings. Their integrity must be assured.

• Staff Trust Degrades
  If internal comms are spoofed or disrupted, confidence in leadership messages, updates, and alerts diminishes—particularly in large, dispersed, and digitally dependent workforces.
• Comms Continuity Fails
  Most general SaaS platforms rely on third-party plug-ins and global cloud APIs to operate. When these are revoked or breached, message delivery ceases. NHS messages must not rely on systems outside NHS governance.
• Inclusion and Equity at Risk
  Complex SaaS breaches often result in only partial system failure. In these cases, digitally excluded or accessibility-dependent users are often the first to lose service—undermining equity goals and widening digital divides.
• Leadership Confidence Erodes
  At Trust Board and ICB level, vendor failures force organisations into reactive mode. Reassuring staff, patients, and partners requires rapid, secure messaging—often across multiple channels. If the platform has failed, the organisation cannot lead.

Trusted Delivery mitigates these risks by removing third-party dependencies, avoiding CRM-sprawl, and embedding every aspect of our platform within NHS security policy, compliance standards, and user expectations.