What Is a Supply Chain Attack?

Definition

A supply chain attack compromises a business through something it trusts and installs or connects to: a software vendor, an update, an open source library, a plugin, or a managed service provider. CISA describes a software supply chain attack as one where a threat actor uses malicious code to compromise software "before the vendor sends it to their customers."

How It Works

CISA's guide Defending Against Software Supply Chain Attacks (April 2021), which draws on NIST's supply chain guidance, names three common techniques:

Hijacking updates. The attacker gets into the vendor's network and inserts malicious code into a routine update, which customers install because it comes from a trusted source.
Undermining code signing. The attacker steals or abuses signing keys so malicious code looks legitimate.
Compromising open source code. Malicious code is added to a public library that many products depend on.

The guide notes these techniques are often combined and that every user of the compromised software is affected. The same logic applies to service providers: if an attacker compromises the remote management tool your IT provider uses, they can reach every client that tool manages. For websites, the supply chain includes every plugin, theme, and third-party script, which is one reason "nulled" (pirated) themes and abandoned plugins are risky.

Real-World Example

On July 2, 2021, attackers deployed REvil ransomware through Kaseya VSA, remote management software used by managed service providers (MSPs). CISA described the attackers as leveraging a vulnerability in the software of Kaseya VSA on-premises products against MSPs and their downstream customers. According to the Justice Department, the malicious code caused Kaseya's own production functionality to deploy ransomware to endpoints on customer networks, encrypting data at organizations around the world. In November 2021, DOJ announced charges against a Ukrainian national for the attack and the seizure of $6.1 million tied to another REvil suspect.

Why It Matters for a Small Business

Small businesses depend on vendors for nearly everything, and a breach at one of them can become your breach. Verizon's 2026 Data Breach Investigations Report found that breaches with third-party involvement rose 60% from the previous year, reaching 48% of all breaches. In its small and medium business analysis, third-party involvement appeared in 55% of breaches. You cannot audit every vendor, but you can know who has access to what. CISA's guide warns that by compromising a software vendor, attackers bypass perimeter defenses such as firewalls and gain privileged, persistent access, and can use the same vendor to get back in if they are removed.

How to Spot It / How DTS Handles It

Questions to ask: which vendors and tools have admin or remote access to your systems; which plugins and themes your site runs and where they came from; whether your IT provider uses MFA on its own management tools; and whether you would hear about a vendor breach.

DTS can help with listing vendor access and limiting remote tool permissions. On WordPress sites, DTS removes unused and nulled components and monitors for unexpected changes after updates. See our hacked WordPress cleanup service, or read about the risks of nulled WordPress themes.

Related Terms

Backdoor: XZ Utils showed how a backdoor can ride in through a library.
Ransomware: the payload delivered in the Kaseya attack.
Nulled plugins and themes: pirated code with built-in risk.
Plugin vulnerability: the WordPress side of supply chain risk.
Vendor risk management: knowing which suppliers can reach your data.
Containment: why disconnecting a trusted tool fast matters.

Sources

CISA, Defending Against Software Supply Chain Attacks (April 2021): https://www.cisa.gov/sites/default/files/publications/defending_against_software_supply_chain_attacks_508_1.pdf
CISA, Kaseya Ransomware Attack: Guidance for Affected MSPs and their Customers (July 2021, archived): https://www.cisa.gov/news-events/news/kaseya-ransomware-attack-guidance-affected-msps-and-their-customers
U.S. Department of Justice, Ukrainian Arrested and Charged with Ransomware Attack on Kaseya (November 8, 2021): https://www.justice.gov/opa/pr/ukrainian-arrested-and-charged-ransomware-attack-kaseya
Verizon, 2026 Data Breach Investigations Report (key findings; SMB focused analysis): https://www.verizon.com/business/resources/Tf3/reports/2026-dbir-data-breach-investigations-report.pdf

Last updated October 14, 2026.