The apps plugged into your systems
You checked the platform. Nobody checked the chat widget, the store app or the connector a contractor installed three years ago. Two September incidents show why that matters.
Most small businesses did some homework on their main systems: Microsoft 365, the accounting package, the online store. Far fewer have a list of what is connected to those systems. Each connection is another company, with its own staff, its own credentials and its own bad days, holding a key to your data.
Brevo, 14 September
Brevo is an email marketing platform that a lot of small businesses use for newsletters, signup forms and website chat. Its features work through scripts that customers paste into their own websites. A long-lived Cloudflare API key with full account permissions had been left in Brevo's application source code, and an attacker obtained it.
With that key the attacker modified three of the scripts customers embed. For about five and a half hours on 14 September, selected visitors to those websites saw a fake "verify you are human" page that told them to paste a command into Windows and run it. On WordPress sites, an administrator who happened to be logged in had a plugin installed silently in the background, which researchers believe was a backdoor. Sansec estimated that more than 100,000 websites loaded the tampered scripts.
None of those businesses made a mistake on their own site. The code came from Brevo's servers, under Brevo's name.
BigCommerce and Ribon, 13 to 17 September
BigCommerce merchants can install third-party apps to add features to their store. Credentials for one of them, Ribon, were stolen in an incident at the company that operates it. For five days the attackers used that app's access to inject scripts into storefronts and pull customer names, email addresses, phone numbers and shipping addresses.
BigCommerce's own platform was not breached. It treated the requests as legitimate, because the merchants had granted the app those permissions. For a Singapore business holding that kind of customer data, the PDPA obligations sit with you as the organization that collected it, whichever vendor lost it.
The Microsoft 365 version
Your Microsoft tenant keeps the same kind of list, under Enterprise applications in the Entra admin center. Every app a member of staff has signed into with their work account and granted permissions to appears there: scheduling tools, PDF signers, AI note-takers, the mail merge add-in somebody tried once in 2023. Some of them can read the whole mailbox of the person who approved them, and they keep that access long after the person has forgotten about it.
The setting worth changing is user consent. Restrict it so staff can only approve apps from verified publishers asking for low-risk permissions, and route everything else to an admin approval request. New connections then stop appearing unnoticed, and staff rarely notice the difference.
In Entra, open Enterprise applications and sort by last sign-in. Remove anything nobody can explain.
Do the same on the integrations or connected apps page of your two most important other systems: accounting, CRM or online store.
List the third-party scripts on your website: chat, analytics, forms, marketing pixels. Each one needs an owner who would hear if that vendor had an incident.
Turn on MFA for every account that can send email in your name or publish to your website, the marketing platform included.
Put it in the calendar twice a year. The list grows on its own, and nobody adds to it on purpose.