Supply Chain Cyber Attacks: Understanding Lessons from Major Breaches - Part One

Key Takeaways

• Supply chain attacks are rising at an alarming rate – In 2023, 15% of all breaches originated from a third-party supplier, up from 9% the previous year.
• Cybercriminals exploit trusted vendors – Instead of attacking organisations directly, threat actors infiltrate software providers, IT service suppliers and cloud platforms to compromise multiple businesses at once.
• High-profile breaches prove no one is immune – Attacks on SolarWinds, 3CX, MOVEit and Okta have demonstrated how a single exploited vendor can expose hundreds or even thousands of downstream organisations.
• Assuming vendor security is a critical mistake – Many businesses fail to conduct continuous monitoring of their supply chain, leaving them blind to risks until a breach occurs.
• Understanding the risk is the first step – Businesses must assess the real-world impact of supply chain attacks before they can effectively secure their own ecosystems.

Introduction

It starts with a single trusted connection—an everyday software update, a routine file transfer, or a vendor with access to your systems. Everything appears normal. Then, without warning, attackers exploit that trust to infiltrate your business.

This is the reality of supply chain cyber attacks. Instead of breaching organisations directly, cybercriminals target third-party providers, software vendors and IT service suppliers, leveraging these trusted relationships to gain access to hundreds—sometimes thousands—of downstream victims.

The data is alarming. In 2023, 15% of all breaches originated from a third-party supplier, up from 9% the year before. High-profile attacks, such as 3CX, MOVEit, and Okta, have proven how devastating these breaches can be, affecting financial institutions, healthcare providers and critical infrastructure. Yet despite the growing risk, many organisations still lack full visibility into their vendor ecosystem.

This article breaks down how supply chain attacks happen, why they are on the rise and what businesses can learn from recent high-profile incidents. The goal is clear—understanding the threat is the first step to mitigating it.

Understanding Supply Chain Attacks

What Is A Supply Chain Attack?

A supply chain attack is a malicious tactic in which cybercriminals target an organisation by infiltrating the vendors, software, or other partners it relies on. Instead of attacking the business directly, attackers insert harmful code or exploit vulnerabilities within a third party’s environment.

When the compromised software or service is delivered downstream, attackers can access countless networks at once.

A Backdoor Into Your Business

Most cyber attacks begin with a weak link. In a supply chain attack, that weak link isn’t your business—it’s a vendor, software provider, or third-party service you rely on. Attackers don’t need to break through your defences if they can slip in through a trusted connection.

This is exactly what happened in the 3CX attack. A routine software update—installed by thousands of businesses—contained malicious code planted by attackers. No one questioned it. No one saw the threat until it was too late. Suddenly, businesses around the world were compromised, all because they trusted a supplier to be secure.

Why Supply Chain Attacks Are Increasing

Businesses depend on third-party providers more than ever, from SaaS platforms to outsourced IT services. Every vendor relationship extends the attack surface, yet few organisations apply the same security standards to suppliers as they do internally.

Cybercriminals know this. They target vendors precisely because they are the weakest link. A single breach in the supply chain gives attackers access to not just one company, but an entire network of victims. This method is highly effective—supply chain breaches increased by 68% year-over-year, according to the latest Verizon Data Breach Investigations Report.

The Different Types of Supply Chain Attacks

Supply chain attacks exploit blind spots—areas where businesses assume security is someone else’s responsibility. The most common entry points include:

• Compromised Software Updates – Attackers inject malware into legitimate updates, as seen in SolarWinds and 3CX, where thousands of businesses unknowingly installed compromised software.
• Exploited Vendor Access – Third-party suppliers often have privileged access to systems but lack strong security controls. The Okta breach in 2023 showed how attackers leveraged a vendor’s support portal to gain unauthorised access.
• Unpatched Vulnerabilities – Delays in updating software leave businesses exposed. Attackers frequently exploit zero-day vulnerabilities in third-party applications before patches are applied.
• Open-Source Dependencies – Many supply chains rely on open-source software, yet few businesses track where these components are used. A single flaw, like the Log4j vulnerability, can create widespread exposure.
• Social Engineering – Attackers bypass security controls by targeting human error. Phishing campaigns against vendors are a common way to steal credentials and escalate attacks.

Every organisation has third-party dependencies. The question is: how well do you know the security of those dependencies? Without continuous oversight, businesses risk inheriting their vendors’ vulnerabilities, along with the consequences that follow.

The Consequences of a Supply Chain Attack

When the Supply Chain Fails, Everything Stops

It doesn’t take a direct attack to cripple a business. When a key supplier is compromised, the fallout spreads quickly. Operations stall, customers are affected and entire industries can feel the ripple effect.

Take the 3CX supply chain attack. A software update—trusted and installed by businesses worldwide—was unknowingly laced with malware.

The result? Thousands of companies were compromised in a single event, with attackers gaining access to internal networks through a product they relied on every day.

Security teams were left scrambling to assess damage, while business leaders faced mounting questions about why this wasn’t prevented.

Supply chain breaches go beyond exposing data - they disrupt everything. The average organisation impacted by a third-party breach in 2023 faced at least three weeks of operational downtime, according to industry reports. For businesses already stretched thin, that’s three weeks of lost productivity, stalled revenue and damage control.

The Financial Fallout

Cyber attacks always come with a price, but supply chain breaches have a habit of escalating costs far beyond the initial impact. A 2023 industry study found that organisations affected by third-party breaches paid, on average, $4.45 million per incident—a record high.

Where does the cost come from? It’s not just incident response and remediation. Businesses hit by supply chain breaches deal with:

• Revenue loss from downtime – If critical systems go offline, customers take their business elsewhere.
• Regulatory fines – Non-compliance with data protection laws can result in steep penalties.
• Contractual disputes – Impacted clients may sue for damages if security agreements weren’t met.
• Rising cyber insurance costs – Businesses with a history of third-party breaches face premium hikes or lose coverage altogether.

A breach doesn’t end when systems are restored. The financial burden lingers long after, affecting everything from cash flow to future investments.

Reputation: The Damage You Can’t Undo

Security failures don’t just cost money—they cost trust. 26% of businesses impacted by third-party breaches in 2023 reported lasting reputational damage. Customers, partners and investors lose confidence and rebuilding credibility can take years.

High-profile supply chain breaches don’t fade quietly. The SolarWinds attack remains a reference point years later, not just for its scale but for how companies affected by the breach struggled to regain trust. Even businesses with no direct involvement suffered because they used SolarWinds products.

The hardest question to answer after a breach isn’t "What happened?"—it’s "Why should we trust you again?"

Regulatory and Legal Exposure

Regulators don’t care whether an attack started with a vendor or an internal system—they expect businesses to secure their supply chain. In 2023, 33% of organisations that suffered a third-party breach faced regulatory action, adding legal and compliance costs to an already damaging incident.

Key risks include:

• GDPR fines – If customer data is exposed, penalties can reach up to 4% of annual turnover.
• Industry-specific compliance failures – Financial services and healthcare face mandatory reporting requirements and stricter penalties.
• Legal disputes with customers and partners – Businesses can be held accountable if they fail to conduct proper vendor due diligence.

Ignoring supply chain security isn’t just a technical risk—it’s a business liability. Regulators are watching and companies that can’t demonstrate proper oversight may find themselves facing more than just a cyber attack.

High-Profile Examples of Supply Chain Attacks

The SolarWinds Attack: A Blueprint for Supply Chain Breaches

The SolarWinds attack remains one of the most devastating supply chain cyber incidents in history. In late 2020, attackers—later attributed to a nation-state—compromised SolarWinds’ software development pipeline, injecting malicious code into an update for its Orion platform. The tainted update was downloaded by 18,000 organisations, including government agencies, Fortune 500 companies and critical infrastructure providers.

For months, attackers moved undetected through these environments, stealing sensitive data and gaining deep access to systems that should have been secure. Businesses that relied solely on traditional security measures never saw it coming—after all, the update was legitimate, signed and came from a trusted vendor.

Key Takeaways from SolarWinds:

• No vendor is too big to be compromised. Even widely trusted, well-established providers can be infiltrated.
• Weaknesses in software development pipelines are a prime target. Without secure build and update processes, attackers can manipulate software before it even reaches customers.
• Detection and response must go beyond perimeter security. Businesses that relied on continuous monitoring and anomaly detection were able to detect the breach faster.

The 3CX Attack: Trusting the Wrong Update

Fast forward to March 2023, and history repeated itself. The 3CX DesktopApp, a widely used VoIP client, was compromised at the source. Attackers infiltrated 3CX’s development pipeline, injecting malware into an official update—one that thousands of businesses downloaded without question.

Unlike SolarWinds, where the attackers operated covertly for months, 3CX’s breach was flagged within weeks by security researchers. Even so, by the time businesses became aware, the malware had already been installed across thousands of endpoints worldwide.

Key Takeaways from 3CX:

• Digital signatures don’t guarantee security. Just because software is signed and approved doesn’t mean it hasn’t been compromised.
• Zero-trust principles are non-negotiable. Businesses that isolated vendor applications and restricted network access limited the impact of the attack.
• Threat intelligence sharing works. Faster detection and industry-wide collaboration helped mitigate damage more effectively than in SolarWinds.

MOVEit, Okta, and TeamCity: The Growing Pattern

In the past two years, supply chain attacks have surged, affecting organisations across industries. Each major breach has reinforced the same hard lessons: vendors are prime targets, security blind spots persist and businesses suffer the consequences of weak third-party oversight.

• MOVEit Transfer (2023): Attackers exploited a zero-day vulnerability (CVE-2023-34362) in Progress Software’s MOVEit file transfer tool, leading to data theft from over 620 organisations, including financial institutions and government agencies.
• Okta Support Breach (2023): Threat actors compromised Okta’s customer support system, gaining access to authentication credentials used by multiple businesses—a stark reminder that even security providers can introduce risks.
• JetBrains TeamCity Vulnerability (2023): A critical authentication bypass flaw (CVE-2023-42793) left software supply chains vulnerable to remote code execution and put development environments at risk.

The Common Thread: Vendor Security Assumptions Are Dangerous

Each of these incidents stemmed from the same fundamental issue: businesses assumed their vendors were secure. They weren’t.

The research is clear—most supply chains lack:

• Risk-based vendor assessments before onboarding suppliers.
• Continuous monitoring of third-party systems to detect early warning signs.
• Strict contractual security requirements that enforce ongoing compliance.

Every business that relies on third parties is at risk. The question isn’t if a vendor will be compromised—it’s when. Companies that fail to take proactive steps won’t just suffer financial losses; they’ll lose customer trust, regulatory compliance and their competitive edge.

How Aztech IT Can Help

When every link in your supply chain matters, having a trusted partner to shore up security and visibility is essential.

Aztech IT offers end-to-end services—from proactive vendor risk assessments to 24/7 threat monitoring—that help close gaps attackers love to exploit. Our approach starts with assessing your current vendor ecosystem, then implementing tailored controls to guard against everything from unpatched vulnerabilities to zero-day exploits.

We also provide compliance guidance to ensure you’re meeting industry mandates and avoiding regulatory pitfalls. By partnering with Aztech IT, you gain a deeper layer of oversight and expertise to stay ahead of the next supply chain threat—long before it reaches your network.

Final Thoughts

The impact of supply chain attacks is undeniable. Businesses are being breached not because of their own security failures, but because of weaknesses in their vendor ecosystem. A single vulnerability in a widely used software platform can expose thousands of organisations, leaving them scrambling to contain the damage.

The case studies explored in this article—from SolarWinds to 3CX—underscore one critical lesson: no vendor is immune and no organisation can afford to take supplier security for granted. The real risk lies in assumptions—assuming vendors are secure, assuming compliance equals protection, assuming threats won’t reach your business.

Understanding the problem is the first step. The next step is action.

In the second part of this series, we break down the practical strategies businesses must adopt to identify weak links in their supply chain, enforce security standards and implement proactive defences before the next attack happens.