A compromise of a single third-party SaaS integration (OAuth app, service principal, delegated credential or integration token held by a vendor), beginning after issuance, is documented as used to access resources in at least three independent customer organizations, by 2027-04-26T12:30Z.
OPEN
- id
- SO-2026-014
- class
- EVENT
- claim
- A compromise of a single third-party SaaS integration (OAuth app, service principal, delegated credential or integration token held by a vendor), beginning after issuance, is documented as used to access resources in at least three independent customer organizations, by 2027-04-26T12:30Z.
- issued
- 2026-10-26T12:30:00Z
- probability
- 0.65
- benchmark
- 0.58
- benchmark kind
- HISTORICAL_COMPARATOR
- benchmark basis
- Sample rebuilt under the exact rule: Salesloft/Drift (Aug 2025) and Klue (Jun 2026) qualify; Gainsight held (upstream element unestablished); ConnectWise does not qualify at issuance (Microsoft 21 Oct: privileged access "in several" cases, not a documented count of three organizations with resource access). Two in 14 months, Poisson 90-day over six months 0.58; sensitivity with Gainsight 0.72. Analyst adjustment +0.07, stated.
- adjustment
- 0.07
- resolution rule
- YES if a primary source establishes (a) one named upstream integration compromise, (b) resource access in three distinct customer organizations, named or counted on the primary page, (c) upstream compromise began after ISSUED_TS. Tokens without documented access do not resolve YES.
- admissibility
- Primary sources only for (a) and (b); Grade A on (a); events after ISSUED_TS; publications to RESOLUTION_TS.
- exclusions
- Not recorded
- resolves
- 2027-04-26T12:30:00Z
- status
- OPEN
- outcome date
- Not recorded
- outcome basis
- Not recorded
- brier
- Not recorded
- benchmark brier
- Not recorded
- resolution source
- EXTERNAL
- experimental
- false
- false positive cost
- A YES on a weak victim count would flatter the EVENT card; the access test is the guard.
- ledger hash
- 90cb7adf89c670ea
- revision log
- 2026-11-06 (CHQ-CORR-2026-033): ledger hash corrected from the shared placeholder c2f1ab40c70d9013 to the per-entry digest 90cb7adf89c670ea, recomputed from the declared serialization of identifier, claim, probability, issued timestamp and resolution rule. Claim, probability, issued timestamp and resolution rule unchanged.
- record links