The number of attacks on these companies’ third-party suppliers doubled in 2024, and cybersecurity experts predict that the problem will only increase this year, the Financial Times reported Monday (Sept. 22).
Tim Erridge, vice president of Europe, the Middle East and Africa at Unit 42 at Palo Alto Networks, said cybercriminals are targeting supply chains in search of a “weak link” in corporate security defenses, according to the report.
“If you ‘breach’ a supplier and it’s got access into many, many top-end organizations that are consuming their services or connected into them, you’re getting a many-for-one return on investment,” he said, per the report.
Verizon found that roughly 30% of the 7,965 cyberattacks that occurred last year originated via a third party, double the amount from 2023, the report said.
Attacks through third-party companies encompass many possible entry points, such as customer service helplines, software providers and technology providers, according to the report.
Advertisement: Scroll to Continue
Nathaniel Jones, vice president of security and AI strategy at Darktrace, said cybercriminals are going after the “soft underbelly” of major companies to try to get “upstream,” per the report.
Meanwhile, the PYMNTS Intelligence report “Vendors and Vulnerabilities: The Cyberattack Squeeze on Mid-Market Firms” found that hackers aren’t just interested in big corporations. They’re also targeting middle-market firms, which increasingly depend on cloud providers, software-as-a-service platforms, managed service and logistics providers.
“But each of those partners, no matter how seemingly peripheral, creates a potential point of entry,” PYMNTS reported Aug. 27.
Rather than battering the digital front doors of dozens of mid-sized companies, attackers target a single vendor whose credentials or software updates offer broad access.
The research found that 38% of fake invoice scams stemmed from vendor or supplier compromise, while 43% of phishing incidents were connected to third-party breaches.
What makes these attacks so effective isn’t their use of sophisticated code but basic psychology.
“Cybercriminals exploit trust, urgency and authority to trick employees into authorizing payments or disclosing credentials,” the report said. “As artificial intelligence tools make phishing emails more convincing and deepfake audio more accessible, the manipulation is becoming harder to detect.”
