A supply chain attack is a cyber attack that reaches your business through a supplier, software vendor or service provider you already trust — the attacker compromises the vendor once and inherits access to every customer, including you. Instead of breaking down your door, they walk in through someone else's. In 2026 it is one of the fastest-growing attack categories, because small businesses that would never be targeted directly are all connected to the same accounting platforms, IT providers and software tools.
Key takeaways
- The attack path is trusted: a compromised vendor, MSP, software update or third-party account, not your own systems.
- Famous examples show the pattern: the SolarWinds update compromise (2020), the Kaseya MSP attack (2021) and the MOVEit file-transfer breaches (2023) each hit thousands of organisations through one vendor.
- For a small business, the realistic entry points are your IT provider, your software vendors and your email correspondence with suppliers.
- Defences are practical: vendor due diligence, MFA everywhere, update discipline, payment verification and trained staff.
- Security awareness training covers the human half — staff must recognise compromised-supplier emails and verify bank-detail changes.
How a supply chain attack works
The attacker picks the supplier, not you. Three versions dominate:
- Compromised software update. Malicious code is inserted into a legitimate product update, so every customer who installs it installs the attack. The SolarWinds compromise of 2020 worked exactly this way, reaching thousands of organisations through a routine update.
- Compromised service provider. An MSP, IT support firm or managed software platform is breached, and the attacker uses its administrative tools to reach every client. The Kaseya incident of 2021 hit roughly 1,500 businesses this way through about 60 MSPs.
- Compromised correspondence. A supplier's email account is taken over, and every customer in the thread history receives convincing invoices or "updated banking details". The MOVEit breaches of 2023 showed how one vulnerable file-transfer tool cascaded data to organisations that had never heard of it.
Why small businesses should care
You may never be a target in your own right, but you use the same accounting software, the same productivity suite and possibly the same IT provider as thousands of other businesses. That shared dependency is the supply chain. ASD's ACSC received more than 84,700 cybercrime reports in FY2024–25 — one every 6 minutes — and a meaningful share of them arrived through a trusted third party rather than a direct attack.
The defences that actually reduce your exposure
| Defence | What it stops | Effort |
|---|---|---|
| Vendor due diligence | Signing with a provider that has no security basics | Low, once per vendor |
| MFA on every business account | Stolen supplier credentials being reused on your side | Low |
| Prompt, automatic updates | Known vulnerabilities like the MOVEit flaw | Low with policy |
| Payment verification by phone | Compromised-supplier invoice and bank-change fraud | Low, needs training |
| Least-privilege access | A compromised vendor account seeing everything | Medium |
| Monthly staff training | The human moment every version depends on | Low with automation |
The last row is where most businesses are weakest. Every supply chain attack ends with a person trusting a legitimate-looking email, installing an update, or approving a payment — which makes it a training problem as much as a technical one.
Where staff training fits
Technical controls do their job only if people do theirs. The specific behaviours that blunt supply chain attacks:
- Verify any payment-detail or bank change by phone on a number you already hold — never from the email itself.
- Treat unexpected "security update" instructions that arrive by email with suspicion; real updates come through the product, not your inbox.
- Approve MFA prompts only when you triggered the log-in.
- Report anything odd in one click, immediately — early reports are how a compromised supplier gets noticed.
Cyber Aware's security awareness training delivers these modules monthly, phishing simulations rehearse the compromised-supplier lures before the real email arrives, and human risk reporting shows where the residual human risk sits. If you want a structured view of your overall exposure before the next vendor renewal, start with a gap assessment.
FAQ
What is a supply chain attack in simple terms? An attack that reaches you through a supplier, software vendor or IT provider you already trust — the attacker compromises them once and uses that trust to reach their customers, including you.
What is a famous example of a supply chain attack? The SolarWinds compromise of 2020, where malicious code hidden in a routine software update reached thousands of organisations. The Kaseya attack of 2021 and the MOVEit breaches of 2023 followed the same pattern through service providers and file-transfer software.
Can small businesses be hit by supply chain attacks? Yes — that is the point. Attackers compromise a shared vendor or IT provider precisely because it reaches many small businesses at once. You do not need to be a valuable target yourself.
How do I protect my business from supply chain attacks? Five practical controls: check vendors' security posture before signing, enforce MFA on every account, keep software updated, verify any payment-detail change by phone, and train staff monthly to recognise compromised-supplier emails.
What should staff do if a supplier sends new bank details? Do not act on the email. Call the supplier on the number you already have and confirm the change verbally. A legitimate change survives the call; a fraudulent one does not.
Does training help against supply chain attacks? Yes. Every version ends with an employee trusting an email, installing something or approving a payment — monthly training and simulations build the verification habits that break that chain.
One last thing
You cannot audit every vendor, but you can make the human link expensive to attack. A workforce that verifies bank changes, distrusts email-delivered "updates" and reports oddities in one click turns the trusted-supplier advantage into the attacker's biggest obstacle.