A Look at Supply Chain Cyber Attacks: With Examples

You've patched your systems. You've trained your team. You've invested in endpoint protection. But what about the software your organization installs without a second thought — the monitoring tool, the file transfer platform, the desktop app your team uses for calls? Supply chain cyber attacks don't come through the front door. They come through a vendor you already trust.

This is precisely why supply chain attacks have become one of the most concerning threat vectors in modern cybersecurity. Rather than targeting an organization directly — which is increasingly difficult as defenses improve — attackers compromise a third party that already has legitimate access to your systems. One poisoned update. One misconfigured OAuth token. One malicious open-source package. The blast radius can affect thousands of organizations at once.

This post looks at some of the most significant supply chain attacks in recent years, the lessons they carry, and how the rise of AI is creating a new and underestimated layer of supply chain risk that many security teams are not yet fully prepared for.

What Is a Supply Chain Cyber Attack?

A supply chain cyber attack occurs when threat actors compromise a component of an organization's supply chain — software, hardware, or a third-party service provider — to gain access to downstream targets. Instead of breaking in directly, attackers exploit the trust that already exists between an organization and its vendors.

The attack surface is vast. Every SaaS tool, open-source library, cloud service, and managed service provider represents a potential entry point. And because these components are often considered trusted by default, malicious code or access can go undetected for weeks or even months.

In a nutshell, the most important things to remember about supply chains are as follows:

• Supply chain attacks exploit the trust organizations place in third-party software, vendors, and service providers — not vulnerabilities in their own systems.
• SolarWinds, 3CX, MOVEit, and XZ Utils each demonstrate how a single compromised component can cascade to thousands of downstream organizations.
• The rise of AI coding tools, agentic systems, and AI-integrated SaaS is significantly expanding the supply chain attack surface: creating insider risk at a scale never before a concern.
• Dependency confusion attacks are becoming more dangerous as AI assistants generate and pull in packages at speed, without the oversight a human developer would apply.
• Continuous monitoring, SBoMs, least-privilege access for AI agents, and defense-in-depth from the foundations up are the core practices that matter most.
• Building a cyber-resilient workforce — one that understands these threats at every layer, from the boardroom to the SOC — is the only sustainable answer to a supply chain threat landscape that will continue to evolve.

Notable Supply Chain Cyber Attack Examples

The following cases are not edge cases. They represent a consistent pattern: attackers identifying where trust is assumed and exploiting it systematically.

1. SolarWinds (2020)

The SolarWinds attack remains one of the most consequential supply chain compromises in history. Suspected nation-state actors — attributed by US intelligence to Russia's SVR — infiltrated SolarWinds' software build environment and embedded malicious code into a routine update for their Orion network monitoring platform. The resulting backdoor, known as SUNBURST, was distributed to approximately 18,000 customers, including multiple US government agencies and Fortune 500 companies.

What made the attack so damaging was its invisibility. The malicious update was digitally signed by SolarWinds itself, meaning it passed standard security checks without question. Attackers operated inside victim networks for months before detection — a strong illustration of how completely perimeter-based defenses fail when the threat arrives through a trusted update.

Key lesson: Digital signatures and vendor trust are not sufficient. Every component of your software supply chain needs to be treated as a potential attack vector.

2. 3CX Desktop App (2023)

In March 2023, researchers discovered that the 3CX Desktop App — a VoIP platform used by over 600,000 organizations worldwide, including American Express, BMW, and Coca-Cola — had been trojansied in what became the first publicly confirmed double supply chain attack.

Investigators tracked the compromise back to an earlier breach of a separate product: Trading Technologies' X_TRADER, a discontinued financial trading application. Attackers used access gained through that breach to infiltrate 3CX's development pipeline, injecting malware into an official update that was then signed with a valid 3CX certificate and distributed directly from their servers.

The cascading nature of this attack — a supply chain breach triggering a second supply chain breach — demonstrates how interconnected modern software dependencies really are. One compromised link can quietly open the door to another.

Key lesson: Zero-trust principles must extend to your entire software supply chain, including the tools your vendors rely on.

3. MOVEit Transfer (2023)

In June 2023, the Cl0p ransomware group exploited a zero-day SQL injection vulnerability in MOVEit Transfer, a widely used managed file transfer product. The attack compromised over 2,700 organizations, including the BBC, British Airways, Boots, Aer Lingus, and Ernst & Young — harming millions of individuals whose personal data was exfiltrated.

MOVEit is a textbook third-party software supply chain incident. Organizations across healthcare industries, finance, and government trusted the same product to securely transfer sensitive files. A single vendor flaw cascaded to hundreds of customers, resulting in data theft across industries before a patch was even available.

The attack additionally showcased the window of exposure organizations face when they rely on a vendor to notify them of a breach. By the time Ernst & Young sent letters to affected individuals, the incident had already been live for weeks.

Key lesson: You cannot rely on vendors to notify you. Continuous monitoring of your own environment is non-negotiable.

4. XZ Utils Backdoor (2024)

The XZ Utils backdoor (CVE-2024-3094) is arguably the most sophisticated open-source supply chain attack ever attempted. Over nearly two years, a malicious actor — posing as a legitimate contributor under the name "Jia Tan" — gradually built trust within the open-source XZ Utils project before inserting a backdoor into the library's release tarballs. The library is used by major Linux distributions, including Fedora, Debian, and Arch Linux.

The backdoor was built to bypass SSH authentication on affected systems — a capability with enormous potential for mass exploitation. It was only discovered by chance: a Microsoft developer noticed unusual SSH latency and investigated further, catching the backdoor before it reached stable Linux releases.

This attack demonstrated that the human layer of the software supply chain — the maintainers, contributors, and community members who build the tools the world relies on — is itself a target. Patient, long-term social engineering of open-source maintainers is a viable attack vector.

Key lesson: Open-source trust is not the same as open-source security. Provenance, contributor verification, and maintainer governance all matter.

AI: A New and Underestimated Layer of Supply Chain Risk

The examples above are significant, but they reflect a rapidly changing threat landscape. The proliferation of AI tools — coding assistants, agentic frameworks, AI-integrated SaaS platforms — is introducing a new dimension of supply chain risk that most security teams have not yet fully reckoned with.

Robert Klentzeris, Security Engineer for AI & Application Security at Immersive, explains it this way:

"The pure amplification in size of people who are now producing code and producing applications is maybe one of the biggest threats. Everyone is a developer, everyone can make things, and get into our code repositories. It is an insider threat that you may have never had to consider or deal with beforehand."

‍

Where once there was a clear separation between developers, product managers, and engineering managers, AI coding tools like Copilot, Cursor, and Claude Code have collapsed those boundaries. Non-technical employees can now generate and deploy code. And with that, democratization comes a vastly expanded attack surface — one where the people introducing dependencies into your codebase may not understand what those dependencies actually do.

Dependency Confusion and AI Hallucinations

One attack vector that is growing in significance is dependency confusion. It is where an attacker creates a malicious package with a name similar to a legitimate one, causing a developer (or an AI coding assistant) to pull in the wrong dependency.

For example, someone has figured out that a package is named slightly differently here compared to in another ecosystem. Now they can exploit that and confuse the AI into using the wrong package name from its training data.

‍

AI tools are not immune to this. In fact, they may amplify it. An AI assistant confidently recommending a package name that sounds correct — but refers to a malicious lookalike — can introduce a compromised dependency into a codebase without the developer ever questioning it. When code is being generated faster than it can be reviewed, that risk compounds quickly.

Third-Party AI Tools and Excessive Permissions

The Vercel breach — one of the most recent AI-era supply chain incidents — illustrates just how quickly third-party tool risk can escalate. A Vercel employee granted an AI productivity tool overly broad OAuth permissions, allowing it to access internal tools and systems. That misconfigured access became the vector for the breach.

"Authentication and authorization, minimize least privileges — don't give these agents, these AI tools carte blanche access to everything. You need to absolutely understand what they have access to, what they're able to do. Is it destructive? Should it only be able to read?"

— Robert Klentzeris, Security Engineer, AI & Application Security, Immersive

As AI agents gain the ability to write files, access databases, send messages, and interact with internal systems, the question of permissions becomes critical. An AI tool that has been granted too much access — even with good intentions — is a supply chain risk waiting to materialize.

Why Periodic Testing Is No Longer Enough

One of the most commonly held assumptions in enterprise security is that periodic testing — quarterly penetration tests, annual audits, scheduled code scans — provides adequate coverage. In the AI era, that assumption is becoming increasingly dangerous.

You can't wait a day, a week, or even every quarter for a pen test report to come and tell you that you've done something wrong. You need continuous monitoring. Are my AI agents acting as they should? Or have they drifted slightly and need to be course corrected immediately?"

The time from vulnerability disclosure to active exploitation has shortened dramatically in recent years. In that environment, a static code scanner or a quarterly test simply cannot keep pace. Security teams need real-time visibility into what their AI systems are doing — and the ability to respond before a behavior drift becomes a breach.

Supply Chain Security Best Practices for 2026 and Beyond

Based on the patterns seen across these attacks — and the emerging AI supply chain risks on the horizon — here are the supply chain security best practices that security teams should prioritize:

• Start with the foundations. Authentication, authorization, and least-privilege access are not optional extras. They are the baseline. As Rob puts it, there is no point deploying sophisticated AI threat detection if you haven't secured the endpoints of your own application.
• Implement a Software Bill of Materials (SBoM). An SBoM gives you a structured registry of every dependency your applications use. If a new dependency is introduced — or an existing one changes name — you can detect it immediately. Given the pace at which AI tools generate and pull in packages, this baseline visibility is more important than ever.
• Apply least-privilege principles to AI agents. Every AI tool, agent, or integration in your environment should have only the access it needs to perform its function — nothing more. Regularly audit OAuth permissions, API scopes, and data access for every AI system in your estate.
• Move to continuous monitoring. Replace or supplement periodic pen tests with continuous monitoring of your systems, agents, and dependencies. Know what your AI agents are doing, detect anomalies in real time, and build the capacity to respond before a drift becomes a compromise.
• Use AI defensively. If attackers are using AI to find and exploit vulnerabilities faster, defenders need to meet that with AI of their own — spotting anomalies in SIEM tools, triaging potential threats at scale, and deploying agents that automatically address lower-severity vulnerabilities while human experts focus on the critical ones.
• Build security in from the start. Security is not a feature to be added at the end of a product cycle. It needs to be part of the product from the first line of code, the first dependency choice, the first vendor integration.

How Immersive Helps Organizations Build Supply Chain Resilience

Understanding supply chain threats is one thing. Building a workforce that can detect, respond to, and recover from them is another. This is where Immersive One comes in.

Immersive One is designed to help security teams — and the wider workforce — develop the practical capability to operate within an increasingly complex threat environment. That includes purpose-built collections on agentic observability, agent governance, AI resilience, application security, cloud security, and incident response: the exact capabilities organizations need to address the supply chain risks outlined in this post.

Rob describes the Immersive One approach across the workforce: from making sure that all employees understand how to interact safely with AI tools and avoid inadvertent data loss, through to helping developers understand what their AI-generated code is actually doing — and helping security engineers build the detection capabilities needed to catch threats before they cause damage.

For organizations that have already experienced an incident, Immersive One offers incident response collections to help teams learn from what happened and build the muscle memory to respond faster next time. For those focused on supply chain threat prevention, the platform provides hands-on, scenario-based exercises across application security, cloud security, and AI threat vectors — equipping teams to address the supply chain threats that are coming, not just those that have already arrived.

Ready to build your team's cyber resilience? Explore the Immersive One platform →

‍