62% of Breaches Now Start With a Vendor: The Rise of Supply Chain Cyber Attacks

This report analyzes the rapid escalation of supply chain cyber attacks in 2024–2025, documenting massive incidents (the XZ Utils backdoor, the MOVEit SQL injection campaign affecting thousands of organizations, and the PowerSchool credential-based breach exposing tens of millions of student records), structural reasons traditional perimeter controls fail, ecosystem-scale trends (malicious OSS packages, AI-assisted package squatting), and practical defenses including continuous external vendor monitoring, SBOMs, pinned dependencies, and contractual/operational changes to third-party risk management.