How can a supply chain attack give attackers access to several organizations?

A supply chain attack allows attackers to gain access to multiple organizations by compromising a third-party vendor that those organizations rely on for software, services, or hardware.1

Because many organizations use the same trusted vendors, an attacker who successfully infiltrates a vendor’s system can use that established relationship as a gateway to reach the vendor's entire customer base. By injecting malicious code or compromising updates at the source, the attacker effectively bypasses the individual security perimeters of each target organization, as the malicious activity arrives disguised as a legitimate, trusted product or service.12

Depending on the scale of the vendor and the reach of the compromised product, this method provides attackers with a highly efficient way to breach numerous systems simultaneously, often without the victims realizing their security has been undermined by a trusted link in their supply chain.1