Cybersecurity is rarely out of the news these days. New ransomware attacks, data breaches, and phishing campaigns continue to impact organizations around the world. While these stories often involve large enterprises, the reality is that businesses of every size face similar risks.
According to the Canadian Centre for Cyber Security, ransomware remains one of the most significant cyber threats facing Canadian organizations and is expected to remain a serious concern for years to come. Cybercriminals continue to evolve their tactics, often combining data theft, extortion, credential theft, and social engineering techniques to maximize their chances of success.
One of the most important lessons from modern cybersecurity incidents is that businesses are often affected through vendors, third-party applications, and external service providers rather than through direct attacks on their own infrastructure.
Two recent cyber incidents reported in the past several weeks demonstrate exactly why organizations should pay close attention to vendor management, cybersecurity preparedness, and business continuity planning.
Cybersecurity Is No Longer Just an IT Problem
Many organizations still view cybersecurity primarily as a technical issue. In reality, it is a business issue.
A successful cyberattack can affect:
- Daily operations
- Customer service
- Revenue generation
- Regulatory compliance
- Reputation and customer trust
Even brief disruptions can create significant challenges for organizations that rely on digital systems to communicate, process transactions, manage customer information, or deliver services.
Recent reports indicate that threat actors continue to target organizations through a combination of phishing attacks, stolen credentials, weak security controls, unpatched systems, and vulnerable third-party platforms.
The following two incidents highlight how varied cyber risks have become.
Cyberattack #1: Eastlink Reports Cyber Incident
In late August, Eastlink, a major Canadian telecommunications provider headquartered in Nova Scotia, reported that it had become the victim of a cyberattack and notified customers about the incident. The organization launched an investigation to determine the scope and impact of the event.
For many Canadians, telecommunications providers represent critical infrastructure. Businesses depend on reliable internet, phone systems, mobile connectivity, and network services to operate effectively.
When a technology service provider experiences a cyber incident, the impact can potentially extend beyond the provider itself and affect customers who rely on those services.
Although every cyber incident is unique, events involving telecommunications companies serve as an important reminder that cyber risk extends throughout the supply chain.
Lessons Businesses Can Learn
Organizations often devote considerable effort to protecting their internal systems while paying less attention to the security posture of external vendors and service providers.
Businesses should regularly ask:
- Which vendors have access to our systems?
- Which vendors store our data?
- What happens if a provider experiences an outage?
- Do we have backup communication methods?
- Have our vendors demonstrated strong security practices?
Cybersecurity today is not just about securing your own network. It is also about understanding the risks associated with the organizations you depend on every day.
Cyberattack #2: McKesson Healthcare Incident
Another notable incident involved McKesson, one of the largest pharmaceutical and healthcare companies in the United States.
In August, the company disclosed an incident involving unauthorized access to third-party applications. Reports indicated that threat actors claimed to have obtained access to significant amounts of healthcare-related information, although the full impact remained under investigation at the time of reporting.
Healthcare organizations remain among the most frequently targeted industries worldwide.
There are several reasons why the healthcare sector attracts cybercriminals:
- High-value personal information
- Critical operational systems
- Regulatory requirements
- Urgency to restore services
- Complex technology environments
Healthcare organizations often manage large volumes of sensitive personal information, making them attractive targets for both ransomware groups and data theft operations.
Perhaps the most significant takeaway from this incident is that the reported access path involved third-party applications rather than a direct attack on core systems.
This is becoming an increasingly common trend.
The Growing Risk of Third-Party Vendors
Many organizations assume that a cybersecurity breach begins when a hacker directly attacks their network.
However, numerous modern cyber incidents involve third-party services, cloud platforms, software providers, and external vendors.
Recent industry analyses found that several major breaches reported during August involved systems or infrastructure managed by third parties rather than the affected organizations themselves.
Consider the typical business environment.
An organization may rely on:
- Microsoft 365
- Accounting software
- Payroll providers
- Cloud backups
- CRM platforms
- Managed IT providers
- Telecommunications providers
- Industry-specific software
Each additional service creates another potential pathway that attackers may attempt to exploit.
This does not mean businesses should avoid using external services. In fact, reputable providers often maintain security resources well beyond what many small businesses can achieve internally.
However, it does mean organizations should carefully evaluate vendor security practices and understand how those providers manage, protect, and back up critical data.
How Businesses Can Reduce Their Risk
While no organization can eliminate cyber risk entirely, several practical steps can significantly improve protection.
Enable Multi-Factor Authentication
MFA remains one of the most effective security controls available and helps prevent attackers from accessing accounts using stolen credentials.
Keep Systems Updated
Vulnerabilities are constantly being discovered. Regular patching reduces the likelihood that known vulnerabilities can be exploited.
Review Vendor Security
Ask vendors about:
- Security certifications
- Backup procedures
- Incident response plans
- Cybersecurity policies
- Data protection practices
Train Employees
Many attacks still begin with phishing emails and social engineering tactics. Regular employee training remains essential.
Maintain Business Continuity Plans
Organizations should prepare for disruptions before they occur.
Questions to consider include:
- How would we operate during an outage?
- What systems are most critical?
- How quickly can we recover?
- Do we have tested backups?
Building a More Resilient Cybersecurity Strategy
The recent incidents involving Eastlink and McKesson serve as valuable reminders that cybersecurity threats continue to evolve and that organizations are increasingly connected to a broader digital ecosystem.
Today’s cyberattacks are not always direct assaults against a company’s network. In many cases, they involve vendors, software platforms, cloud services, and third-party applications that organizations trust with critical business data.
The good news is that proactive cybersecurity measures, strong vendor management practices, employee awareness training, and trusted IT partnerships can dramatically reduce risk.
Cybersecurity is no longer a question of whether an organization may face threats. The real question is whether the organization is prepared when those threats eventually arrive.
DMS iTech is here to help businesses strengthen their cybersecurity posture with practical guidance, proactive monitoring, employee awareness, secure backups, and responsive IT support. Whether you need to assess current risks, improve your defences, or develop a stronger incident response and business continuity plan, our team can help you build a security strategy that fits your organization.
