Turns out your biggest breach risk might come from a vendor’s acquisition — and an old OAuth token you didn’t even know ...