Unauthorized Access to Third-Party Data

A subject accesses, views, searches, queries, or retrieves data belonging to, supplied by, or maintained on behalf of a third party without a legitimate business purpose or authorization to do so. The subject may possess valid technical access to the relevant system or dataset but uses that access outside the requirements of their role, assigned duties, contractual responsibilities, or other approved activity.

Third-party data may include information relating to suppliers, vendors, business partners, applicants, professional advisers, counterparties, acquisition targets, or other external parties. The infringement occurs through the unauthorized access itself, regardless of whether the information is subsequently disclosed, altered, copied, or exfiltrated.