US breach reinforces need to plug third-party security weaknesses