Supply chain attacks, explained properly

The uncomfortable truth of modern security: your risk is not bounded by your own network. Every supplier with your data, your credentials, or a connection into your systems extends your attack surface into organisations you don’t control and mostly can’t see. Supply chain attacks are what happens when adversaries notice that before you do.

The three distinct attacks hiding under one name

“Supply chain attack” gets used for three quite different things, and the defences differ, so keep them separate:

1. Software supply chain. The attacker compromises software you install — poisoning a vendor’s update mechanism (SolarWinds remains the textbook case), a build pipeline, or an open-source package your developers pull in. You did nothing wrong except trust an update. These are the rarest and most sophisticated.

2. Service-provider compromise. The attacker breaches a company that holds access into many customers — an MSP with admin rights on hundreds of client networks, a file-transfer product used by thousands of enterprises. One intrusion, mass victims. The MOVEit campaign of 2023 is the defining example: one product’s vulnerability became hundreds of organisations’ breach notifications — most victims had never heard of the appliance that leaked their data, because it was their payroll provider’s appliance.

3. Supplier data breach. The least exotic and by far the most common: a supplier that holds your data gets ransomed. Nothing touched your network — but your employee records, contracts or customer data are now on a leak site under someone else’s name. Watching 1,100+ ransomware claims a month in our tracker, this is the version that quietly hits the most organisations: the victim is a payroll bureau, a logistics firm, a law firm — and the real blast radius is their client list.

Why attackers love the supply chain

The economics are compelling: one compromise, many victims — and trust relationships bypass defences. Traffic from your MSP looks legitimate because it is, until it isn’t. The supplier’s security budget is usually a fraction of yours, so the attacker takes the cheapest door into the most valuable room.

There’s also an accountability gap doing a lot of work: you can’t patch a supplier, audit questionnaires measure the supplier’s ability to fill in questionnaires, and by the time a breach notification letter arrives, the attacker has had your data for months.

What actually helps

Know who your suppliers are. Genuinely — most organisations can’t produce a complete list. You cannot watch what you haven’t named.

Watch the claims, not the questionnaires. Ransomware crews publish victims daily. If one of your suppliers appears on a leak site, you want to know that week — not when the letter arrives next quarter. This is a monitoring problem with public data, and it’s automatable.

Map the blast path before you need it. For each critical supplier: what do they hold, what can they reach, what’s the move when they’re hit? An hour per supplier, done calmly in advance, replaces a very bad fortnight done in a panic.

Least privilege for suppliers. The MSP doesn’t need domain admin everywhere, forever. Connection-level trust is where service-provider compromises become your incident instead of their news story.

For software: inventory and delay. Know what you run (an SBOM, even a rough one), and let non-critical updates soak for a few days — most poisoned-update campaigns get caught fast.

Go deeper

This problem is why we built supplier monitoring against live ransomware claims directly into our platform — the graph already connects claimed victims to sectors and crews daily in the ransomware tracker, with open feeds if you want to build your own watch. Related: how ransomware gangs pick victims and the KEV catalog.