Supply Chain and Third-Party Attacks: Risk You Don’t Directly Control

Supply chain attacks exploit trust. Instead of targeting your business directly, attackers compromise a vendor, product, or service provider and use that relationship as a pathway in.

As organisations become more interconnected, this has become one of the fastest-growing and least visible risks.

Third-Party Risk Is Increasing Rapidly

Recent data shows a clear upward trend:

• Third-party involvement in breaches has doubled from 15% to 30%
• Third-party relationships are now recognised as a major driver of large-scale incidents
• NIST guidance stresses that supply chain risk must be embedded into overall risk management, not treated as a separate issue

The key issue is scale. A single compromised supplier can impact hundreds or thousands of downstream customers.

Why Attackers Target the Supply Chain

Vendors often have:

• Trusted access into internal systems
• Shared data or infrastructure
• Privileged roles such as IT support or identity management

This makes them efficient entry points. Instead of attacking multiple organisations individually, attackers compromise one supplier and gain access to many.

How These Attacks Play Out

A recent Australian example illustrates how supply chain risk materialises in practice.

• Qantas (2024): third-party breach via a supplier platform
  Qantas disclosed a cyber incident linked to a third-party system used within its operations. The breach did not originate from Qantas’ core infrastructure, but from a connected external provider. This reflects a common pattern where attackers target vendors with weaker controls to gain indirect access to customer data and internal workflows.

What this demonstrates:

• The entry point is outside your perimeter
  Even with strong internal controls, exposure can occur through trusted integrations or shared systems.
• Access is legitimate, not forced
  Attackers often operate through valid connections, making activity harder to distinguish from normal operations.
• Impact depends on data and access scope
  The risk is shaped by what the vendor can access, not just whether they are compromised.

This type of incident reinforces a key point: security is only as strong as the weakest connected party.

The Business Impact

Supply chain attacks tend to have broader and more complex consequences than direct attacks.

• Breaches can spread across multiple organisations simultaneously
• Remediation often requires coordination with vendors, increasing response time
• Business interruption and cascading operational issues are common

Additionally, fraud tied to vendor workflows, such as business email compromise, continues to generate substantial financial losses globally.

Indicators of Third-Party Compromise

Because activity often originates from trusted sources, detection is challenging.

Common warning signs include:

• New or unexpected vendor accounts
• Unusual API or integration activity
• Unexpected outbound connections from approved tools
• Configuration changes following software updates
• Access patterns originating from vendor infrastructure that deviate from normal behaviour

These signals often appear legitimate unless closely monitored.

What Actually Reduces Risk

Managing supply chain risk requires controlling access, validating trust, and preparing for failure.

1. Limit and control third-party access
Apply least privilege, enforce MFA, and use time-bound access. Avoid persistent VPN connections in favour of monitored access points.

2. Strengthen vendor due diligence
Use structured assessments to evaluate security practices. Frameworks from CISA and the UK NCSC provide practical baseline questions.

3. Require incident readiness from vendors
Contracts should include clear breach notification timelines, cooperation requirements, and evidence of security controls, especially for high-risk providers.

4. Validate software and updates
Monitor the integrity of software sources. Use allowlisting and staged rollouts to reduce exposure to compromised updates.

5. Treat leaked credentials as urgent
Secrets exposed in repositories or vendor systems must be rotated immediately. Delayed remediation creates a large window for exploitation.

The Bottom Line

Supply chain attacks shift the risk boundary beyond your organisation. Security is no longer defined only by internal controls, but by the practices of every connected vendor.

Effective defence depends on reducing trust assumptions, increasing visibility, and planning for third-party failure as a normal scenario rather than an exception.