Supply chain attacks: from SolarWinds and MOVEit to 2026

Third parties now feature in 30% of breaches. Lessons from SolarWinds, MOVEit, Salesloft Drift, Shai-Hulud and 2026 cases, and how to manage vendor risk.

2026-10-04

Breaking into companies one by one is hard work. Compromising the software vendor, integration tool or code library they all use is far more efficient. Verizon's 2025 DBIR found third-party involvement in 30% of breaches, double the previous year's 15% (Help Net Security).

The trust placed in a supplier can become the attacker's way in overnight. A legitimate update, an over-permissioned integration token or an automatically pulled open-source library can carry an intrusion past traditional controls.

The defining cases

SolarWinds (2020): Russian spies backdoored the Orion monitoring suite; about 18,000 organisations downloaded the poisoned update and roughly 100 were hacked. The SEC sued the company and its CISO, a judge set aside most claims in July 2024, and the SEC moved to dismiss on 20 November 2025 (The Register).

MOVEit (2023): Cl0p exploited a file-transfer flaw, hitting 2,773 organisations and over 95.7 million individuals, 78.9% of known victims in the US (Emsisoft).

2025: tokens and packages

Salesloft Drift: attackers accessed Salesloft's GitHub between March and June 2025, reached Drift's AWS environment and stole OAuth tokens to raid customers' Salesforce instances. Cloudflare said "hundreds" of firms were hit, including Google, Zscaler, Palo Alto Networks and CyberArk (The Register). Google attributed the activity to UNC6395. One broadly permissioned SaaS connector was enough to expose data at hundreds of customers.

Shai-Hulud: CISA warned in September 2025 of a self-replicating worm that compromised more than 500 npm packages, stealing GitHub tokens and AWS, Google Cloud and Azure keys and spreading by publishing tainted versions under compromised developers' names (CISA). CISA advised pinning dependencies to releases before 16 September 2025, rotating all developer credentials immediately and mandating phishing-resistant MFA on GitHub and npm.

2026: same playbook, larger scale

CM-Alliance lists TanStack's "Mini Shai-Hulud" compromise (attributed to TeamPCP, with OpenAI and Grafana among those affected), the "Megalodon" campaign that infected over 5,500 GitHub repositories in May 2026, a Vimeo–Anodot token breach exposing about 119,000 users, and a Trellix source-code breach. The pattern is consistent: attackers now target developer environments, CI/CD pipelines and access tokens rather than only the finished product.

Case	Year	Vector	Reach
SolarWinds	2020	Poisoned update	~18,000 downloads
MOVEit	2023	File-transfer flaw	2,773 orgs
Salesloft Drift	2025	OAuth tokens	Hundreds of firms
Shai-Hulud	2025	npm packages	500+ packages
Megalodon	2026	Malicious commits	5,500+ repos

Supply chain attacks also blur accountability. When the vendor is breached, the customer still owns the notification duties, the regulatory exposure and the reputational damage, which is why contracts and response playbooks matter as much as technical controls.

Regulators are watching

NIS2 lists supply chain security among minimum measures (McCann FitzGerald), and almost a third of major ICT incidents reported under DORA in 2025 stemmed from third parties (Ropes & Gray).

Third-party risk checklist

Inventory vendors, SaaS integrations and code dependencies.
Prioritise those with privileged access or sensitive data.
Review and expire OAuth tokens; revoke unused ones.
Pin dependencies and monitor lock files.
Enforce phishing-resistant MFA for developer accounts.
Write notification deadlines, audit rights and exit plans into contracts.
Prepare a response playbook for when the vendor is the one breached.