Supply Chain: Hackers' New Highway to Hundreds of Networks

Cyber attacks are increasingly leveraging supply chains, allowing hackers to infiltrate networks via trusted third-party vendors. Infiltrating one organization can provide access to hundreds of downstream targets. This tactic has seen a significant surge, with approximately half of breaches analyzed in 2024-25 involving third-party compromise, a 60% increase from the prior year.

The scale of these attacks is immense. A 2020 incident involving Russia's foreign intelligence agency compromising SolarWinds' Orion software exposed around 18,000 customers. More recently, the British retailer Marks and Spencer reportedly lost £131 million after a breach originated from a third-party supplier.

Open-source software platforms further exacerbate these risks, as seen in a May attack on GitHub that compromised nearly 4,000 software projects. Experts suggest artificial intelligence could accelerate these attacks by enabling faster code analysis. Companies are advised to create software bills of materials to catalogue their supply chains and continuously monitor for threats.

Defensive measures include limiting supplier access and implementing attack surface monitoring. Governments are also stepping in, with the UK government's cyber resilience pledge and pending legislation to make supply chain security guidance mandatory. Despite advancements in defense, attackers are expected to continue evolving their methods.