NIS2 Part Two: How Stolen Vendor Data Fuels Downstream Attacks

In part one of this NIS2 series, we examined why vendor questionnaires fall short and how third-party breaches impact downstream organizations across Europe. But what happens after a supplier containment phase ends? The long-term danger lies in how attackers leverage exfiltrated supplier data to launch hyper-targeted social engineering attacks against an organization’s employees.

A supply chain incident does not end when a service provider detects, contains, or recovers from an attack. Any exfiltrated data creates persistent risk. Both the German BSI and other European authorities have highlighted that attacks on service providers are increasing, with stolen data frequently deployed for extortion and targeted phishing.

Cybercriminals take exfiltrated customer, patient, or operational records and use that accurate data to build hyper-personalized, highly credible messages that bypass standard human skepticism.

How Stolen Databases Become Phishing Infrastructure

A clear example of this threat mechanism occurred between September 2025 and February 2026 across Germany, France, Lithuania, and the United States. According to CERT-EU’s Cyber Brief 26-03 , a campaign targeting freight and logistics organizations compromised more than 1,600 unique credentials and caused “significant disruption” to supply chain operations. Subsequent threat research into an exposed Git repository associated with the operation revealed:

• 52 phishing domains set up specifically for the campaign.
• 75,840 target email addresses compiled in a stolen operational database.
• Real-time multi-factor authentication (MFA) interception using combination spearphishing and voice phishing (vishing).
• Social engineering tactic: Attackers impersonated legitimate logistics platforms that victims used daily (such as Timocom and DAT Truckstop) and recruited targets via logistics Telegram groups.

Neither Timocom nor DAT Truckstop were compromised directly; instead, credentials and MFA codes were harvested directly from the human users logging into those systems.

Similarly, following the Trenitalia ticketing database breach in Italy, the organization explicitly warned passengers that stolen booking data would likely be used to craft fraudulent messages and phishing attempts linked to real passenger journeys.

The Human Security Gap in NIS2 Transpositions

Appropriate handling of credentials, MFA codes, and secure login behavior represents a fundamental challenge. While NIS2 attempts to address human risk, these articles are not transposed to the same extent into national laws:

• NIS2 Directive Provisions: Article 21(2)(g) mandates basic cyber hygiene and training, while Article 20(2) requires management bodies to undergo training and offer similar training to their employees.
• Germany: Transposed cyber hygiene and employee training under § 30(2) Nr. 7 BSIG and management training under § 38(3) BSIG, but omitted explicit transposition of the second limb of Article 20(2) regarding general staff training obligations.
• Italy: Transposed both management and employee training obligations in full under Article 23 of D.Lgs. 138/2024.
• France: Draft legislation requires training for management and "personnes exposées aux risques" (risk-exposed personnel), while leaving broader guidelines to be confirmed.

Across all three jurisdictions, the requirement that directly mandates workforce training for the supply chain is the element most heavily trimmed by national legislators. Currently, the only binding EU text obliging an entity to mandate security training for its suppliers' personnel is Implementing Regulation (EU) 2024/2690, which applies only to the digital sector.

Looking Forward: AI Amplification in the Supply Chain

The security landscape is growing more complex as artificial intelligence is integrated into enterprise supply chains, amplifying existing identity-based threats.

Organizations can no longer limit identity management to human users alone; they must account for scenarios where an automated agent embedded inside a third-party Software-as-a-Service (SaaS) platform is compromised or goes rogue. Regulatory frameworks like NIS2 do not provide exemptions for AI tools or autonomous agents. Managing supply chain risk requires securing the human layer while simultaneously auditing and securing the agentic landscape.

Key Takeaways for Security Leaders

1. Recognize That Data Loss Is Phishing Preparation: Treat any third-party data breach as an immediate precursor to targeted spear phishing and vishing campaigns against your staff.
2. Address MFA Interception Risks: Implement training that prepares employees for real-time social engineering and vishing tactics designed to steal MFA codes.
3. Fill the Regulatory Training Void: Do not rely solely on national NIS2 transpositions to enforce security awareness. Implement comprehensive security training across the whole supply chain.
4. Prepare for Agentic AI Risks: Audit SaaS integrations for automated tools and AI agents to ensure third-party permissions are contained.

Get a personalized demo and see how KnowBe4’s AI-native SAT continuously trains users, simulates real-world attacks, and reinforces secure behavior in real time to safeguard your organization against sophisticated threats.