A credential record references a supplier's website. Someone adds the supplier to a breach tracker. By the next meeting, the tracker is being treated as confirmation that the supplier's infrastructure was compromised.
The evidence may support a much narrower statement: an account appeared alongside that service hostname.
Write the observation without adding a cause
Separate the account identifier, observed service, available date context, and any independently supported incident claim. A source label can suggest a line of inquiry without establishing attribution.
MITRE's browser-credential technique illustrates one reason service credentials can be obtained from somewhere other than the service's own systems. It is an example of a possible mechanism, not an explanation for every record.
Use language such as “work address observed with the vendor service” until stronger evidence supports a different conclusion.
Send the vendor a useful question
A hypothetical procurement owner wants to contact a supplier after several work addresses appear in findings. The useful request asks whether those accounts exist, who owns them, and whether the supplier has relevant authorized activity records.
Do not send an accusatory message claiming a breach solely from a hostname. Do not send full passwords in an ordinary email as proof.
Use the organization's established security or vendor-management contact. Share the minimum necessary context through an agreed channel.
Keep three investigations distinct
| Workstream | What it can establish |
|---|---|
| Your identity review | Whether the work account remains relevant and protected |
| Your service-owner review | Whether the vendor relationship and application use are current |
| Supplier investigation | What the supplier can substantiate about its own systems and activity |
These investigations may inform each other. They do not automatically produce the same conclusion.
A supplier's inability to confirm a historical event is not proof that nothing happened. It is also not permission to present an unverified incident as established.
Update the register with evidence levels
An internal tracker can record an observed association, a claim under review, or a confirmed incident with its supporting source. Keep dates and responsible owners visible.
NIST's supply-chain guidance provides the broader risk-management context; the organization still needs a precise evidentiary standard for its own registers.
Close the exposure action separately from the attribution question. An account can need a security review even when the origin of its credential remains uncertain.
Read stealer logs versus breach evidence and vendor access ownership. Careful wording improves coordination because it asks each party to confirm facts it can actually know.