Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

A previously known malware strain, SHA1-HULUD, has resurfaced with a large-scale software supply-chain attack targeting the NPM ecosystem. More than 300 open-source NPM packages were maliciously modified within a short window, leading to the theft of sensitive credentials and over 20,000 compromised GitHub repositories.

Following the Jaguar-Land Rover disaster, another cyberattack has shaken a major industry. The danger of attacks on the supply chain has never been clearer. The issue now revolves around what organizations can do to protect themselves and their supply chain partners. Wall Street spent a tense weekend in late November 2025 when news broke that SitusAMC, a major technology vendor serving hundreds of real estate lenders across the United States, had suffered a significant cyberattack.

The widening attack surface signals a critical risk, and your supply chain is the prime target. Attackers exploit vulnerabilities that were inserted long before the system was onboarded. This enables them to infiltrate data or disrupt systems at any stage, making supply chain attacks a direct and growing risk. A third-party breach compromises your vendor, but a supply chain attack targets you, which is why organizations need to make supply chain cybersecurity a business priority.

In today’s digital economy, every organization—whether a law firm, retailer, or financial services provider—is now part of someone’s critical infrastructure. A dangerous misconception persists: that Internet of Things (IoT) devices and Industrial Control Systems (ICS) are only concerns for industrial or manufacturing sectors. In reality, these technologies are quietly embedded in everyday operations across nearly every industry.

Ransomware attacks can ripple through supply chains, causing serious disruption and massive financial consequences for multiple businesses in one fell swoop. As such, CISOs are spending more time considering how to keep operations secure as ecosystems span across dozens, if not hundreds, of vendors, contractors, and digital dependencies. With this in mind, the UK government has released a strategic framework to help organizations secure their supply chains. Let’s explore that guidance.

The code your team writes is only a fraction of what ends up in your final product. For many teams, the majority is open-source code from third-party packages. This reliance on external dependencies creates a complex software supply chain, and each link in that chain is a potential entry point for attackers.

When it comes to managing cyber risk, the financial sector is squarely at the top of the food chain. It’s simple economics (and the plot of many movies): financial institutions have the money, and cybercriminals are always looking for ways to take it. As a result, institutions have invested heavily in strengthening their internal systems and cybersecurity controls. Those investments have paid off.