The Credential Relay Economy: How Supply Chain Attacks Chain Through SaaS Vendors
The 2026 Verizon DBIR put third-party involvement in confirmed breaches at 48 percent, up 60 percent year over year after doubling the year before. IBM's Cost of a Data Breach 2026 report added the response-side number: breaches that begin at an infected supplier take an average of 258 days to identify and contain, eleven days longer than the global average of 247 days. Behind the statistics sits a specific mechanic worth understanding: stolen credentials from one vendor being replayed against that vendor's customers.
The Telus Digital chain
In March 2026, Telus Digital confirmed a major breach. ShinyHunters claimed nearly 1PB of company and customer data. The entry point was not Telus infrastructure. Attackers used Google Cloud Platform credentials harvested in the earlier Salesloft Drift breach, where the group downloaded Salesforce data from 760 companies, scanned support tickets for credentials and auth tokens, and then replayed those credentials into downstream platforms.
The relay continued inside Telus: after downloading from BigQuery instances, the attackers ran trufflehog over the exfiltrated data to find more secrets and moved laterally for additional downloads. One SaaS compromise feeding the next, with each hop widening the victim set.
The LiteLLM poisoning window
August 2026 produced a second data point. A supply chain poisoning attack against the LiteLLM API gateway operated in an attack window of roughly 40 minutes and reached about 2,500 organizations, with around 195TB of password data reported exposed. A single upstream dependency, a package and a gateway used by thousands of companies, transmitted the compromise to all of them within the time it takes a meeting to run long.
Law enforcement moved eventually: Australian police arrested two alleged TeamPCP members, the group linked to poisoning attacks against Trivy, LiteLLM and code hosting platforms. Arrests of core members do not undo the exposure of downstream credentials, which is why rotation speed matters more than takedown announcements.
What the numbers argue for
Three practices follow directly from the evidence above:
- Treat vendor breach disclosures as rotation triggers, not news items. The Telus chain started with credentials that had been sitting in someone else's support tickets for months.
- Inventory which SaaS platforms hold integration credentials to which systems, so the rotation list is ready before an incident names a vendor.
- Watch for secret-scanning activity in your own data: trufflehog-style tooling ran inside a victim's cloud during the Telus incident, and the same scanning works for defenders. The 258-day containment figure is the cost of learning about a supplier compromise from the outside. The credential relay economy runs on that delay.
References
- Verizon 2026 Data Breach Investigations Report (third-party breach share)
- IBM Cost of a Data Breach Report 2026 (containment timelines)
- Baidu Baijiahao and Sohu coverage of the Telus Digital and Salesloft Drift chains, September 9, 2026
- CSDN weekly reports on LiteLLM poisoning and TeamPCP arrests, September 2026
