Cyberattacks against software supply chains have gotten so widespread that at least one of them happens every two days, a report from Cyble has claimed.
Software supply chain attack happens when a threat actor compromises a software development company, or a platform, that another company uses in its products and services. As a result, that other company ends up being compromised as well, and most of the time, hackers end up stealing business and customer data, or hijacking company source code.
As per the report, in the six-month period between February and August 2024, there were at least 90 successful supply chain attacks, with the report also citing “claims of successful supply chain attacks” on the dark web.
US firms in the crosshairs
Most of the attacks targeted IT providers, the researchers further explained, adding that it was unsurprising given these companies’ reach. A third of the total (30 attacks) targeted IT providers, followed by technology product companies with 14 attacks. Aerospace & defense (9 breaches), manufacturing (9 breaches), and healthcare (8 breaches) were the next most frequent victims of supply chain attacks.
IT providers might be the biggest target, but very few industries are actually spared. Cyble says that of the 25 verticals it tracked, 22 suffered at least one supply chain attack this year.
Geographically, companies located in the United States suffered the most (31 attacks), followed by those in the UK (10). Germany and Australia were next with five each, while Japan and India had four.
Cyble says that the most effective place to control software supply chain risks is in the continuous integration and development (CI/CD) process.
“Carefully vetting your partners and suppliers and requiring good security controls in contracts are ways to improve third-party security,” the researchers concluded.
More from TechRadar Pro
- The role of employee awareness in preventing supply chain attacks
- Here's a list of the best firewall software around today
- These are the best endpoint security tools right now
