An unauthorized third party is any person, group, or system that receives or accesses data without permission. In security and privacy incidents, this phrase usually means the information left the control of the original organization and reached an outside actor that was not approved to see it.
This matters because unauthorized access changes an event from a simple exposure risk into a confirmed confidentiality breach. Attackers often become unauthorized third parties by stealing credentials, abusing cloud or SaaS permissions, exploiting weak account recovery, or tricking support staff. Defenders look for this condition in authentication logs, unusual downloads, shared-link abuse, and unexpected data exports. Preventing it depends on strong identity controls, least-privilege access, phishing-resistant MFA, careful help-desk verification, and tight data-minimization practices.