Essays

Essay

Being a Supplier for a Large Studio: More Difficult Than Ever

Studios have become targets of orchestrated hacks and deliberate breaches, and their risk management and governance have stepped up. Now they expect their suppliers to keep pace.

By Tobias Jaeger · First published on Medium on 12 September 2017

A client was recently asked to provide a certification they did not have. While I cannot go into detail about this specific case, what they were asked to provide is similar to an ISO 9001 certification. Many smaller companies that have managed to become a supplier to a large television or film studio specialise in a certain product or service; they are not experts in risk management. In the coming years the requirements will likely only increase.

As part of their agreement with their much bigger client, the company was asked to put systems in place that would increase the security of the materials it was handed to complete the project. They complied and absorbed the cost of the new system, as they were of course keen to keep the deal. Risk intelligence company RiskVision estimates that about 80% of breaches originate with a supplier or vendor. It is therefore understandable that large film and television studios insist that their vendors take every aspect of security as seriously as they do. Often the main objective of a breach is to hold the materials to ransom and demand money, usually in Bitcoin, for not releasing them.

In recent cases of breaches and hacking, the attack almost always originated with a supplier, as in the leak of Orange Is the New Black in April 2017, which The New York Times reported at the time. Hackers targeted suppliers of the large studios, knowing they would be much easier to get into than the studios themselves. In the case of Orange Is the New Black, the hack targeted a popular post-production facility that works with many major television studios. It is a good example of the pressure on anyone working on high-profile projects. Even small companies need to implement systems usually found only at large corporations, which can more easily afford them. Ultimately, the risk management of large studios such as Disney will have to be matched to a large extent by their suppliers. The supplier and vendor codes of conduct enforced by big media corporations already put a lot of pressure on anyone doing business with them, and smaller, more niche players feel the heightened expectations.

On another project a couple of years ago, a client faced a problem: employees running two of its television productions started to behave strangely, and reports came in from set that the producers had at times shown up drunk or high. Production funds went missing and equipment was reported as ‘lost’. The exposure these employees created was high, as both productions ran over budget and much of the spend was unaccounted for. The client spent a lot of time and money on forensic accounting and electronic auditing. Luckily, its IT department had set up a redundancy in the email server that kept a copy of all incoming and outgoing email in a protected partition. When the employees were finally confronted with their misconduct they, as you would expect, denied all allegations. The lengthy audit that followed showed they had deleted several email chains in which they joked about their misconduct and their plan to use production funds for personal purposes such as a holiday or, in one case, a personal vehicle. The damage was done, but thanks to a pre-emptive IT setup and a brilliant accounting firm, all misconduct was discovered and documented, and proof was established. In the end the client could not recoup the misused funds, but it could show clearly who was accountable for what, when, where and why. For me personally, it was a reminder that complete security can never be achieved, but good systems raise the threshold for a perpetrator getting away with it.

The music industry looks very similar: The New York Times reported in May that Lady Gaga’s stem files, the original song files used for editing, had been leaked after a social engineering hack. By sending very targeted emails to label executives, hackers obtained copies of these vital files.

To fight these attacks and secure their assets, large television and film studios are likely to raise their minimum standards for suppliers and vendors in the coming years, as the threat of a breach through one of them is only going to grow. Anyone doing business with a studio will have to step up in hiring, training, IT, governance, risk management and finance. From a financial perspective, this means budgeting properly for these extra expenses and including them in long-term financial planning as well as in the short-term pricing of services.

Added to Media CFO on 25 October 2026 from the original Medium post. Spelling and small grammar slips are corrected, and a link to RiskVision’s retired website is removed; the wording is otherwise unchanged.