Reassess Supplier Security and Contract Terms After Emerging Cyber Signals

What happened

Miinto reported an unauthorized party accessed its internal order management system and may have retrieved customer order and payment data. The company has notified police and data protection authorities and warned customers to watch for phishing. Buyers should treat this as an active supplier incident and verify containment evidence and any downstream integrations affected

Why the category manager should care

Do not assume containment; require supplier evidence of root cause and a map of affected integrations before accepting service continuity claims

Key facts

• Unauthorized access to internal order management system
• Exposed data types include names, email and physical addresses, phone numbers, and payment me
• Incident reported to police and relevant data protection authorities

What happened

European parliamentarians failed to reach the threshold to stop reintroduction of an interim rule that allows voluntary scanning of chats for child sexual abuse material, with end‑to‑end encrypted platforms largely excluded. The interim measure can remain in force until a permanent law is adopted, so platform suppliers may present technical options to comply or seek contract changes

Why the category manager should care

Anticipate vendors proposing scanning or monitoring options; prepare contract language that limits pass‑throughs and preserves encryption responsibilities where required

Key facts

• Attempt to abolish interim rule fell short of required parliamentary threshold
• Interim rule permits voluntary detection/reporting of CSAM but excludes E2EE platforms
• Interim measure would remain valid until a permanent solution is passed

What happened

OpenAI ended its standalone Atlas browser and integrated browsing and agent features into ChatGPT Work after researchers showed prompt‑injection and URL‑handling vulnerabilities. The company is shifting capabilities into an enterprise offering rather than a separate product. Buyers should treat embedded browsing and agent features as new endpoint classes requiring security testing and contractual commitments

Why the category manager should care

Treat browsing/agent features like new endpoint categories and require explicit security attestations and integration tests before adoption

Key facts

• Atlas will stop working on August 9 as features move to ChatGPT Work
• Security issues included prompt‑injection attacks and malformed URLs exposing prior site data
• OpenAI combined Atlas, Codex, and desktop features into a single workplace offering

What happened

Industry coverage shows customers are increasingly choosing smaller, domain‑specific AI models for routine tasks instead of frontier general models. Vendors including Microsoft are shipping medium‑sized models for focused workloads, which can be easier to host and control. Procurement can use this trend to demand dedicated instances, locality guarantees, or narrower SLAs where data control matters

Why the category manager should care

Evaluate domain models as a way to limit exposure to large shared models and to retain easier control over data locality and cost

Key facts

• Shift toward domain‑specific models for tasks such as summarization and speech‑to‑text
• Microsoft's MAI family targets multiple use cases with medium‑sized models as alternatives to
• Smaller models can run multiple instances on a single accelerator, lowering per‑task compute

What happened

Microsoft's sustainability report shows emissions rose due to datacenter construction even as renewable purchases and reuse programs advance. The company highlights Scope 2 growing and continued Scope 3 prominence tied to facility buildouts. For buyers, this means hosting suppliers may seek to reconcile expansion costs with sustainability claims, creating negotiation points on pass‑throughs and resilience testing

Why the category manager should care

Clarify how suppliers allocate the cost of expansion and energy resilience measures and do not accept open‑ended pass‑throughs tied to construction or energy accounting

Key facts

• Datacenter construction contributed to a reported increase in greenhouse gas emissions
• Scope 2 contribution to emissions rose noticeably in the latest reporting
• High reuse rates reported for decommissioned server components under circular programs