One compromised system inside your network can be enough to put the whole customer table in someone else's hands.
BleepingComputer reports that Japanese furniture retailer Nitori found an attacker had accessed a system on its network, and that 37.62 million customer records may have been stolen. CISA added CVE-2026-20320, an XML external entity flaw in Cisco BroadWorks, to its catalog of vulnerabilities exploited in the wild: an unauthenticated remote attacker could use it to read sensitive configuration information. The Block reports Kava Lend lost roughly $3.8 million to a hack, with the KAVA token down nearly 40 percent.
The entry point varies. What you control is the blast radius: inventory every service, job and admin tool that can read the full customer table, cut that list down, and set retention limits on order and profile data. I do security reviews of payment and account flows, access paths included. Send me yours and you get scope, cost and timeline within a day.