Separate Incidents Expose Third-Party Security Risks