Supply Chain Attacks in 2021: It Takes a Village

This report examines the rising trend of supply-chain attacks and “big game hunting,” detailing 2021 incidents such as the Accellion breach (zero-days, web shell, Clop-related data extortion) and the Codecov compromise (malicious modification of a Bash uploader affecting many downstream customers). It highlights attacker sophistication, large-scale impact potential (Codecov’s wide customer base), lessons on insecure decommissioning and build processes, and the need for holistic vendor risk management.