Supply chain cyberattacks remain a significant challenge in 2025. The 2024 BCI Supply Chain Resilience Report revealed that nearly 80 per cent of organisations experienced disruptions in their supply chains, while 34 per cent of respondents reported a cyberattack as a cause of the disruption. Threat actors increasingly target suppliers and third-party vendors to breach larger organisations, with financial service providers at the top of the target list.
Recently, more than 11,000 customer information from DBS and the Bank of China were compromised by a cybersecurity attack on their printing vendor. These attacks exploit vulnerabilities in interconnected systems, creating a ripple effect that broadly disrupts operations. Financial losses, reputational harm, and potential legal repercussions are just some of the outcomes.
The growing complexity of supply chains only amplifies the risks, making proactive measures more critical than ever. Suppliers, especially smaller businesses, often lack the resources and expertise to implement strong cybersecurity measures, making them prime targets for attackers seeking to infiltrate larger, well-protected organisations.
Understanding the most common supply chain threats and adopting strategies to mitigate them is essential for safeguarding business operations and data integrity.
Why are supply chains so vulnerable?
The primary reason supply chains are exploited for cyberattacks is the disparity in cybersecurity levels between large enterprises and their suppliers. Smaller suppliers often operate with limited resources, focusing on operational performance metrics like rapid delivery times or cost efficiencies, unintentionally sidelining cybersecurity considerations.
This is a problem, as while businesses keep increasingly relying on third-party software solutions and digital services, vulnerabilities in digital supply chains have emerged as a critical risk factor. Like their physical counterparts, software supply chains consist of multiple tiers of suppliers, often involving complex interdependencies, including open-source software libraries, cloud infrastructure, SaaS applications, authentication services, and security tools. Vulnerabilities can emerge at any tier, whether through unpatched code, misconfigured cloud storage, or compromised third-party IT services, creating significant security risks.
Also Read: How tech startups can transform the supply chain in Southeast Asia
This complexity is a key challenge, as mapping the components beyond first-tier suppliers is difficult, yet vulnerabilities often originate from lower-tier ones. Hence why attackers exploit these blind spots, leveraging security weaknesses in lower-tier modules to gain access to broader systems. Vulnerabilities like Log4j show how a single weak link can expose entire ecosystems, making supply chain security a critical priority.
One of the most notable global supply chain cyberattacks occurred in 2020 with the SolarWinds incident. SolarWinds, a provider of IT infrastructure management tools, became the target of state-sponsored cybercriminals who compromised its widely used Orion software. The attackers inserted malicious code into a routine software update, which was then deployed by unsuspecting customers.
SolarWinds reported that in all, this breach impacted approximately 18,000 organisations worldwide. The list of affected organisations includes U.S. federal agencies, state and local governments, and major corporations, exposing sensitive data and systems to unauthorised access.
Supply chain risks
Supply chain cyber risks come in many forms. Whether it’s ransomware, data theft, or fraud, attackers exploit vulnerabilities in suppliers, partners, and even open-source code to breach networks. Examples like SolarWinds or the breach of 3CX illustrate how widespread and damaging these attacks can be.
Additionally, sophisticated methods such as business email compromise (BEC) and credential theft demonstrate the lengths threat actors will go to infiltrate supply chains. Even trusted partners like managed service providers (MSPs) are not immune, as cybercriminals recognise that compromising a single MSP can open the door to numerous downstream targets.
Other risks include:
- Software vulnerabilities
Digital risks such as zero-day exploits, or other software vulnerabilities create potential entry points for cybercriminals, leading to threats such as ransomware attacks, malware infections, data breaches, process disruptions or intellectual property theft, among others.
- Supplier fraud
Supplier fraud, or vendor fraud, is another rising threat. For instance, business email compromise (BEC) attacks often involve fraudsters impersonating suppliers to trick clients into transferring funds. Attackers typically hijack email accounts and send fake invoices with altered payment details, exploiting trust within supply chain relationships.
Fraudsters also increasingly employ sophisticated social engineering techniques, including AI-generated voicemails, and deepfake videos, making these attacks challenging to detect.
- Data security
Data protection remains a critical concern within supply chain security. Ensuring data integrity requires robust encryption practices and access restrictions, particularly for third-party integrations.
Since third-party vendors often have access to sensitive data to some extent, such encryption safeguards are essential to prevent cybercriminals from exploiting these connections. This can go a long way toward preventing large-scale incidents such as data breaches.
Also Read: Why it is imperative to invest in digitalising the supply chain
How to mitigate supply chain risks?
To address these threats, businesses of all sizes must make supply chain security a cornerstone of their cybersecurity strategies.
Effective software security begins with a clear understanding of an organisation’s digital assets and rigorous due diligence when onboarding new suppliers. Maintaining an up-to-date inventory of all open-source and proprietary tools in use is essential for ensuring visibility across the software ecosystem. By employing tools like software composition analysis (SCA) and ensuring timely patching of vulnerabilities, businesses can guard against the hidden dangers within widely used components.
Organisations should remain vigilant for known vulnerabilities and apply patches promptly, recognising that concerns about malicious updates should not delay critical software maintenance. Moreover, breaches affecting third-party software vendors require careful attention, as they can ripple through and impact operations.
Systems should also be regularly audited to identify and eliminate redundant or outdated services, protocols, or tools that could pose security risks. When partnering with software suppliers, it is crucial to assess their risk profiles by examining their security practices. Organisations should also establish clear security requirements for vendors, including regular code audits, robust change control procedures, and stringent security checks for code components.
Additional measures include requesting penetration tests to uncover vulnerabilities in critical software, strengthening safeguards by enforcing strict access controls, and implementing multi-factor authentication (MFA) to secure development processes and build pipelines. Finally, deploying multi-layered security software is recommended to ensure comprehensive protection across the organisation’s infrastructure.
These measures, coupled with clearly defined policies and regular communication with suppliers, lay the groundwork for a resilient supply chain.
Emerging best practices
As the threat landscape evolves, so too must supply chain security practices. Government agencies and industry organisations have introduced frameworks to guide businesses in managing supply chain cybersecurity. For example, the National Institute of Standards and Technology’s (NIST’s) Cybersecurity Supply Chain Risk Management framework offers a systematic approach to assessing and mitigating risks.
Also Read: The digital revolution in supply chain management: Efficiency, visibility, and resilience
Beyond technical tools, a cultural shift is required. Supply chain managers must integrate cybersecurity into their supplier selection processes and foster continuous development of suppliers’ security capabilities. This approach ensures that cybersecurity becomes an integral part of supply chain management, much like quality control or sustainability efforts.
The path forward
Supply chain cyberattacks are not going away. In fact, they are expected to increase as attackers exploit the growing complexity and interconnectivity of modern supply chains. With more than 70 per cent of Singapore organisations negatively impacted by a cybersecurity breach within their supply chain, there is no time to wait in implementing cybersecurity solutions.
By adopting a prevention-first approach that combines technological tools, rigorous supplier management, and a commitment to continuous improvement, organisations can significantly reduce their exposure to these threats. In an era where the weakest link can compromise an entire ecosystem, supply chain security must be a priority for every business leader.
—
Editor’s note: e27 aims to foster thought leadership by publishing views from the community. Share your opinion by submitting an article, video, podcast, or infographic.
Enjoyed this read? Don’t miss out on the next insight. Join our WhatsApp channel for real-time drops.
Image courtesy: Canva
The post The most common supply chain threats and how to mitigate them appeared first on e27.