A contractor's gateway let attackers into a bank. A school swimming lesson shows whose breach it is.

On 13 October Palo Alto Networks' Unit 42 published an account of an intrusion at a European bank it doesn't name. The bank's own security team spotted odd activity on its central IT system. Unit 42 traced it back several months, to unauthorized VPN access attempts and then to the way in: "The intrusion originated through a third-party-managed external gateway appliance that was not properly configured to enforce strict authentication." Using stolen credentials, the attacker scanned thousands of internal systems, ran months of password guessing against administrator accounts, scraped internal documentation, and finally tried to exploit a WSUS flaw on the server that pushes software to the whole bank. Endpoint detection stopped it there. Unit 42 found no backdoors left behind.

None of it was clever. "Sometimes the most damaging intrusions begin with the simplest oversights," the write-up says, and it names "missing multi-factor authentication (MFA) on a VPN" as the kind of thing it means. The question I keep coming back to is the one in the title of the post, third-party risk. When the front door is run by a contractor and the contractor leaves it unlocked, whose breach is it?

My first reaction was that this is the vendor's failure

The bank didn't configure that gateway. Someone it paid to manage it did. If I were on the bank's side I'd want that on the record.

But that reaction doesn't survive the bank's own customers. They never chose the gateway's manager. They can't see the contract, can't check the configuration, and wouldn't know the firm's name. From where they stand there's only the bank. And the regulator agrees with them. Under the EU's Digital Operational Resilience Act, Article 28(1)(a), financial entities that use contracted ICT services "shall, at all times, remain fully responsible for compliance with, and the discharge of, all obligations under this Regulation and applicable financial services law." The contract moves the work. It doesn't move the answer.

That's a rule, though, and rules can feel arbitrary. I wanted to know why it's the right rule, and the clearest reasoning I found is about a ten-year-old in a swimming pool.

The cross: Woodland v Essex County Council

On 5 July 2000 a ten-year-old girl from Whitmore Junior School suffered a serious brain injury during a school swimming lesson in Basildon. The lesson was in school hours and part of the curriculum. The swimming teacher and the lifeguard weren't council staff. They were supplied under a contract with a firm called Direct Swimming Services. The council's position was simple: we hired competent specialists, so if anyone was careless, it was them.

In 2013 the UK Supreme Court disagreed, unanimously. Lord Sumption set out when a duty can't be handed to someone else even if the work can. The claimant "is a patient or child or for some other reason is especially vulnerable". There is an antecedent relationship between them. "the claimant has no control over how the defendant chooses to perform those obligations". And "the defendant has delegated some function which is an integral part of the positive duty". When those hold, the school answers for the contractor's negligence in that function. The court was careful that "It is not an open ended liability"; it covers only what was actually handed over.

Read the third test again with the bank in mind. The customer has no control over how the bank chooses to run its network. The bank chose to put a contractor on its edge. Keeping the bank's systems closed to strangers is about as integral to being a bank as keeping pupils safe in a lesson is to being a school.

Where the comparison breaks

A bank customer isn't a child, and Woodland is about personal injury, not data or money. Lord Sumption's first test, special vulnerability, is the weakest fit. The honest version is narrower: the customer is in the child's position on the test that matters most here, the lack of any control over how the work is done. I don't know of a court that has carried Woodland into a cyber case, and I'm not a lawyer.

There's also a fair point on the bank's side. It caught this itself, contained it, and Unit 42 found no lasting foothold. Whatever went wrong at the edge, the inside held. And the bank still has a claim against the contractor. Non-delegable doesn't mean the vendor walks away. It means the bank pays first and recovers second.

What that suggests

The practical version is about how a bank thinks about the gateway, not the lawsuit. If the duty stays with you, the device is yours in every way that matters except the invoice. So you'd want to see its authentication settings yourself, not take the vendor's word, and you'd want your own alerting on what comes through it. This bank's team did catch the attack, but inside, on its central systems, after months of attempts at the edge.

I wrote about an agent-caused outage and who was on call for it, which is the same question with software instead of a contractor: handing off the doing doesn't hand off the answering. And Korean banks that paused AI deregulation after attacks were a reminder that a bank's perimeter is judged by its weakest door, not its best.

What I'm confident of, and what I'm not

The intrusion details are established from Unit 42's write-up, which is vendor-reported and names neither the bank nor who managed the gateway. DORA's wording and the Woodland judgment are established from the texts. That Woodland's reasoning fits a bank's customers is inferred: the case is about a child in a pool, and no court I know of has applied it to a VPN. That boards will start treating vendor-run edge devices as their own is a guess.

The claim, in one sentence: you can hand a contractor the work, but when the people relying on you can't see or choose who does it, you can't hand over the duty; the contract decides who pays you back, not who answers for the breach.

Sources

Antonio Diaz and Ruben Castillo, Unit 42, "The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk", 13 October 2026. https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/

Cyber Security News, "Attackers breach European bank through third-party gateway and target WSUS server", 14 October 2026. https://cybersecuritynews.com/attackers-breach-european-bank/

Regulation (EU) 2022/2554 (DORA), Article 28. https://www.springlex.eu/en/packages/dora/dora-regulation/article-28/

UK Supreme Court, Woodland v Essex County Council [2013] UKSC 66, press summary, 23 October 2013. https://caselaw.nationalarchives.gov.uk/uksc/2013/66/press-summary