CEO’s phone number. Leaked.

Sergio Ermotti runs UBS, one of the world's largest banks. In October 2025, his direct phone number appeared on the dark web.

Not because UBS got breached. Because Chain IQ got breached.

The thing is, UBS doesn't use Chain IQ. Their vendor did. So how did Ermotti's direct line end up on the dark web via Chain IQ?

June 12, 2025. Attackers broke into Chain IQ Group AG, a procurement vendor. They grabbed employee records from 19 of Chain IQ's clients. Over 130,000 records total. Posted everything online.

UBS was in there. So was Pictet. Swiss Life. Axa. FedEx. IBM. Swisscom.

None of them had ever contracted with Chain IQ directly. Their procurement vendors had. And when Chain IQ got compromised, these companies found out the same way everyone else did: when their employee data showed up for sale.

Here's what makes this worse:

You can't vet a vendor you don't know exists.

You know which vendors you hired. You might even know which vendors they hired if your vendor risk program is solid.

But do you know which vendors those vendors use? The platforms they're all hosted on? Where your data actually lives in this chain?

Most organizations don't. They track direct contracts. They don't map what those contracts sit on top of.

The numbers aren't improving:

96% of Europe's largest financial institutions were hit by a third-party breach in the past two years, according to SecurityScorecard. That's up from 78% just two years before.

This problem is accelerating, not slowing down.

Why traditional vendor assessments miss this:

Your vendor questionnaire asks about security controls at one company. Not their subcontractors. Not the infrastructure providers two layers down. Not the shared platforms that create single points of failure.

When Chain IQ got breached, none of the affected organizations could have prevented it through better vendor management. They didn't have a relationship with Chain IQ to manage.

This is fourth-party risk. And it requires a different approach.

What CRISC covers that most risk programs don't:

How to map risk beyond direct vendor relationships. How to identify concentration risk when multiple vendors share infrastructure. How to build continuous monitoring for exposures you can't see through annual assessments.

It's not about better questionnaires. It's about understanding how risk actually flows through your ecosystem.

And professionally? Organizations desperately need people who can manage these complex risk scenarios. CRISC positions you as someone who understands enterprise risk at a level most security professionals don't reach.

Our next CRISC Bootcamp runs June 1-3, 2026. Three days with Kelly Handerhan covering everything ISACA tests. 146 topics, 695 flashcards, 850 knowledge assessments, 500+ practice questions, 24 mind maps, and 4 implementation tools for real-world risk work.

Learn more and enroll

P.S. We don't offer a CRISC MasterClass yet. Want us to notify you when we do? Reply to this email.

Stay secure,
The DestCert Team