Supply Chain Attacks: Three Real Cases and the Lessons for Small Firms

Short answer: the biggest supply chain attacks of recent years didn’t break into their victims directly. They went through a supplier: a payroll bureau, a pathology lab, a software update. Small businesses rarely make the headlines, but they’re in exactly the same position, relying on a handful of outside firms for data, systems and money. Here are three well-documented cases and what each one means for a firm of ten or twenty people.

Want to know which of your suppliers could cause you the same problem? Ring 0151 452 3060 and a person picks up.

1. MOVEit and Zellis, 2023: your data, someone else’s breach

What happened. In 2023, criminals exploited a flaw in MOVEit, a widely used file transfer product. One of the organisations using it was Zellis, a UK payroll provider. Through that one breach, staff data belonging to Zellis’s clients was stolen, including employees of British Airways, Boots and the BBC. None of those employers was attacked directly. Their data was taken from a supplier’s supplier.

The small-business lesson. Your payroll bureau, your accountant and your HR software hold some of the most sensitive data you have: bank details, National Insurance numbers, home addresses. Do you know which of your suppliers hold it, and would they tell you quickly if something went wrong? That’s the first thing to find out. Our guide to checking your suppliers gives you ten questions to ask each of them.

2. Synnovis, 2024: when a supplier goes down, so do you

What happened. In June 2024, Synnovis, the pathology service provider to several major London hospitals including Guy’s and St Thomas’ and King’s College Hospital, was hit by ransomware. Blood tests couldn’t be processed normally, and thousands of appointments and operations were postponed. The hospitals hadn’t been breached themselves. The service they depended on had stopped.

The small-business lesson. The risk isn’t only data being stolen. It’s a supplier you rely on simply not being there for days or weeks. If your practice management software, your cloud phone system or your IT provider went dark tomorrow, what would you do? Write down the answer for your two or three most critical suppliers: how you’d keep working, who you’d call, and where you’d find your data. It’s the part of a business continuity plan most small firms skip.

Not sure what you’d do if a key supplier went down? We help small businesses plan for it, including backups that don’t depend on the supplier. See business continuity or ring 0151 452 3060.

3. SolarWinds, 2020: when the update is the attack

What happened. Attackers got into the systems of SolarWinds, which makes IT management software, and slipped malicious code into a routine update of its Orion product. Around 18,000 customers installed the update. Because it came from a trusted vendor, through the normal update process, it wasn’t treated as suspicious.

The small-business lesson. You can’t personally vet every software update, and you shouldn’t stop updating: unpatched software is a far bigger risk. But you can limit the damage any one piece of software can do. Tools and accounts should have only the access they need, admin rights should be rare, and someone should notice when something behaves unusually. We cover the software side of this in your software supply chain.

What the three cases have in common

In each case, the organisation that suffered did nothing obviously wrong on its own systems. The weak point was someone they trusted. That’s the uncomfortable truth about supply chain security: your cyber security is only as strong as the suppliers who can reach your data, your systems or your ability to operate.

The practical response for a small business isn’t to distrust every supplier. It’s four habits:

• Know who holds what. A one-page list of suppliers, what they can reach and who to call.
• Ask the questions. Once when you sign up, once a year after that.
• Limit access. Separate accounts, switched off when not needed. See managing supplier access.
• Plan for the outage. Know how you’d keep working if a critical supplier disappeared for a week.

DSIT’s 2025 survey found 43% of UK businesses reported a breach or attack in the previous year. Some of those started with a supplier. And remember you’re somebody’s supplier too: see when your customers check your cyber security.

Start with the list. Book fifteen minutes with Eric this week and we’ll help you work out which suppliers matter most and what to ask them. Ring 0151 452 3060 and a person picks up.