Supply Chain Attacks

In recent years, enterprises have been looking for formulas to overcome the challenges of supply chain disruptions, labor issues, rising transportation costs and responsibilities such as creating a low carbon footprint, as well as vital issues such as protecting against digital attacks.

Over the last decade, supply chains have adopted the technologies of the era and rapidly adapted to competitive requirements, turning to digitalization, automation and integration to adapt to rapidly changing dynamics and reduce costs. Of course, it was not possible to stay out of these developments, but in addition to the many important advantages brought by technology, there have been examples of cyber attacks in the supply chain and their devastating consequences. As organizations rapidly turned to remote working in the global pandemic, security vulnerabilities such as employees’ transition to the cloud and cloud systems not being ready for this change, and clicks by unconscious employees that create security breaches have also increased. For this reason, it has become necessary for organizations to be informed and protect their digital systems to prevent possible crises in this sense.

Supply chain attacks have been a nightmare for organizations since the beginning of the pandemic. It is stated that supply chain hacker attacks, which cause major threats to organizations’ commercial activities and relationships around the world, have quadrupled in the second year of the pandemic. A supply chain attack is technically defined as the slippage of some form of malicious code or even a malicious component into a trusted piece of software or hardware.

By compromising a single supplier, spies or saboteurs can hijack distribution systems to turn any application they sell, any software update they ship, even the physical equipment they ship to customers, into trojan horses. With a single well-placed intrusion, through a click-through item, such as an email link, a vendor can create a springboard into the networks of its customers, sometimes with hundreds or even thousands of victims.

Five years ago, Maersk, the Danish integrated shipping company, a shipping and logistics giant famous for its shipping containers, suffered a devastating supply chain attack. A phishing attack infected Maersk’s entire network, including some 50,000 thousands of applications and servers across 600 sites. The attack, which began via an email link, cost between US$200 – 300 million, with much more money lost in recovery costs. Access to all 1,200 applications was lost and around 1,000 were destroyed. Data from backups was preserved, but the applications themselves could not be restored from them as they would be immediately re-infected. Around 3,500 of the 6,200 servers were destroyed and could not be restored. Another devastating cyber attack targeted James Hall & Company in Preston, Lancashire, which operates Spar’s tills and IT systems, in December last year. After the attack, which affected more than 300 Spar convenience stores in the north of England, the chain was forced to close its doors, but the stores that remained open were unable to accept cash and card payments.

The pathways to a cyber-attack on the supply chain are often based on exploiting basic human error. Attacks not only cause organizations’ systems to crash, but also have critical consequences that can lead to various communication crises due to vulnerabilities and risks, and ultimately to reputation management disruption. Therefore, it has become important for organizations to raise awareness of major attacks and security to help them protect themselves from supply chain attacks. Given the digital transformation of the supply chain over the last decade, companies need to think deliberately and visionary about how to shape and manage their supply chains, especially post-pandemic.

Employee absent-mindedness or negligence in not following security rules is cited as another major threat to an organization’s security. Experts list common mistakes as: using the same basic passwords for multiple online accounts and not enabling two-factor authentication for logins. However, experts say that one of the biggest risks is working in public places using an unsecured or public Wi-Fi connection. According to experts, hackers can use an unsecured wifi connection to infiltrate through a laptop or mobile device and access supply chain information. In this way, important information such as emails, passwords and website logins can be compromised, and once the suppliers’ network is accessed, the entire supply chain can be at risk.

To protect against attacks, solutions such as obtaining a systemization service where digital transformation is offered by professional organizations and then always supported with expert support ensure success in preventing possible crises. Experts also recommend cybersecurity software that scans malicious e-mail content and flags suspicious e-mails, cybersecurity audits of high-risk suppliers, and training on security awareness. They also recommend awareness-raising solutions such as working with a vendor risk management company to check the risk level of suppliers, identifying, and raising awareness of high-risk employees with access to sensitive data, and training employees to detect phishing emails. In this sense, it is critical for enterprises to frequently update their cybersecurity policies and practices to protect themselves from potential attacks.