Supply Chain Attack Statistics Guide: Third-Party Breaches and Malicious Packages

Supply chain attack statistics are quoted everywhere, but most of the numbers in circulation cannot be traced back to the report that supposedly produced them. This page collects the supply chain and third-party figures that we could confirm on the publisher's own page or PDF: the Verizon 2026 Data Breach Investigations Report (DBIR), the Sonatype 2026 State of the Software Supply Chain report, ENISA's supply chain threat landscape and ENISA Threat Landscape 2026, the UK government's Cyber Security Breaches Survey 2025/2026 and the IBM Cost of a Data Breach Report 2026. Each figure carries its report name, publisher and edition in the same sentence or table row, and figures we could not trace are left out. It is written for security leaders, third-party risk teams and AppSec engineers who need defensible numbers for risk registers, board papers and supplier programmes. Last reviewed: October 2026.

Key takeaways

• Third parties now feature in about half of breaches. The Verizon 2026 DBIR finds third-party involvement in 48% of breaches, which Verizon describes as a 60% increase on the previous year's dataset.
• Malicious open source packages are an industrial-scale problem. Sonatype's 2026 State of the Software Supply Chain report logged more than 454,600 new malicious packages in 2025 and more than 1.233 million known and blocked packages in total, with over 99% of 2025's open source malware on npm.
• Few organisations look at supplier risk at all. The UK Cyber Security Breaches Survey 2025/2026 finds only 15% of businesses review risks from immediate suppliers and 6% look at their wider supply chain.
• Suppliers often cannot say how they were breached. ENISA's Threat Landscape for Supply Chain Attacks (2021) found that in 66% of the 24 attacks it analysed, suppliers did not know, or failed to report, how they were compromised.
• Supply chain compromise raises breach cost. IBM's Cost of a Data Breach Report 2026 Canadian release names supply chain compromise as the largest cost-increasing factor in Canada, adding about CA$367,899 per breach.

Headline statistics

Statistics by theme

Third-party involvement in breaches

• Share of breaches: the Verizon 2026 DBIR Executive Summary states that breaches with third-party involvement increased by 60% from the previous dataset, reaching 48% of total breaches. The executive summary does not limit this to software supply chain attacks: it is a broad measure of partner and supplier involvement, and the summary separately highlights exposures through third-party cloud services without MFA.
• Dataset size: the same 2026 DBIR Executive Summary draws on more than 31,000 security incidents, of which more than 22,000 were confirmed breaches, in 145 countries.
• Entry point: the 2026 DBIR finds exploitation of vulnerabilities is now the leading initial access vector at 31% of breaches, ahead of credential abuse at 13%. Many of the exploited products are supplier-built edge and file-transfer systems, which links the third-party and vulnerability trends. See the Vulnerability and Exploitation Statistics Guide.
• Shared providers in Europe: ENISA Threat Landscape 2026, covering incidents from 1 January to 31 December 2025, does not give an overall supply chain share, but describes "the compromise of shared platforms and service providers affecting multiple organisations". Its examples include a ransomware attack on a Swedish IT supplier that affected around 200 municipalities and regional authorities, and a breach through an external appointment-service provider that reportedly exposed data on about 100,000 people.

Malicious packages and open source malware

• Single campaigns can dominate counts: Sonatype's 2026 report attributes more than 150,000 malicious packages to the IndonesianFoods campaign in a couple of days (169,538 in its campaign table), built to self-replicate every seven seconds. A year-on-year jump in package counts can therefore reflect one noisy campaign rather than a broad rise in targeted attacks.
• State actors: the same Sonatype 2026 report tracks more than 800 packages associated with the Lazarus Group, 97% of them on npm, with droppers in about 98% and secrets exfiltration in about 64% of them.
• Self-propagating worms: Sonatype 2026 lists Shai-Hulud as compromising more than 500 npm packages in days, plus a second wave and several GlassWorm waves against VS Code extension marketplaces. The Shai-Hulud npm Worm 2025 page shows how stolen npm and GitHub tokens let one infection republish a victim's own packages. See also the GlassWorm Campaign 2025.
• Dependency surface: Sonatype 2026 puts the average modern application at around 180 dependencies, each a potential path for a malicious update.

Supplier attack techniques and targets

ENISA's Threat Landscape for Supply Chain Attacks, published 29 July 2021 and covering attacks discovered from January 2020 to early July 2021, remains the most cited structured analysis of how suppliers are attacked. It is old and small, so use it for patterns, not prevalence.

The gap between suppliers (66% unaware) and customers (fewer than 9% unaware) is the most useful ENISA finding for defenders: the customer usually sees the symptoms first, so contracts need breach notification clauses that work in both directions. The SolarWinds Supply Chain Compromise, which falls in ENISA's window, is the archetype of an attack on supplier code.

Supplier risk management practice

Source for every row: UK Department for Science, Innovation and Technology (DSIT), Cyber Security Breaches Survey 2025/2026, published 30 April 2026, fieldwork August to December 2025, sample 2,112 businesses and 1,085 charities. Even among large businesses, fewer than half review the risk posed by their direct suppliers.

Cost and impact

• Breach cost overall: the IBM Cost of a Data Breach Report 2026, produced with the Ponemon Institute from breaches at 602 organisations between March 2025 and February 2026, puts the global average cost at $4.99 million, a 12% increase and a record high.
• Supply chain as a cost factor: IBM's Canadian release for the 2026 report, dated 29 July 2026, names supply chain compromise as the largest factor increasing breach costs in Canada, adding about CA$367,899 per breach on average. We could not find a global supply chain cost figure on IBM's own pages, so none is quoted here.
• Third-party code in AI systems: IBM's 2026 global release reports that compromised APIs, applications or plug-ins caused 27% of breaches targeting AI models or applications. See the AI Supply Chain and AI-BOM Guide.

What the numbers mean for defenders

• Treat suppliers as part of your attack surface: with third-party involvement in 48% of DBIR 2026 breaches, supplier access, supplier-built software and shared service providers deserve the same threat modelling as your own estate. See the Third-Party Risk Management Guide.
• Close the review gap first: the DSIT survey shows most UK organisations never assess supplier risk. Starting with a tiered inventory of suppliers with network access, data access or code in production is cheap and fixes the biggest gap.
• Gate package intake, not just vulnerabilities: Sonatype's malware counts are about intentionally malicious code, which CVE scanning does not catch. Use a repository proxy or firewall that blocks known malicious packages, pin versions and require a cooling-off period for new releases. See the Software Supply Chain Security Guide and SBOM Guide.
• Protect publishing and CI credentials: secrets exfiltration is a primary payload in the Lazarus packages and in worms such as Shai-Hulud. Short-lived tokens, trusted publishing and scoped CI secrets cut the blast radius. The tj-actions/changed-files Compromise shows a stolen bot token turning a widely used GitHub Action into a secret leaker.
• Plan for the supplier not knowing: ENISA's 66% finding means your detection must work without supplier input: monitor supplier accounts and integrations for anomalous use and keep a response playbook ready. See the Supply Chain Compromise Response Playbook.

Where identity fits

Many supply chain incidents are identity incidents underneath: a maintainer's npm token, a bot's GitHub personal access token, a supplier's OAuth integration or a vendor support account. The figures above count the outcome, not the credential, so read them alongside the Non-Human Identity and Secrets Statistics Guide and the Third-Party Access Guide.

Framework mapping

Common failure patterns when using supply chain statistics

• Quoting "third-party involvement" as "supply chain attacks": the DBIR 48% includes partner credential misuse and breached hosting providers. Say "third-party involvement" when you cite it.
• Comparing malicious package counts across vendors: each package-security vendor counts differently, and campaigns like IndonesianFoods inflate totals. Compare one publisher's figures year on year only.
• Citing a 2021 analysis as current prevalence: ENISA's 24-attack study is useful for patterns, not for "how many attacks happen". Always give its year.
• Using numbers from roundup pages: many widely shared supply chain percentages trace back to a vendor blog that cites another blog. If you cannot find the figure on the publisher's page, do not use it.
• Mixing currencies and scopes: IBM's Canadian supply chain cost is in Canadian dollars and for Canada only; do not present it as a global figure.

Methodology notes and caveats

All six sources are recurring, so this page can be refreshed when each new edition appears: DBIR usually in spring, IBM in late July, the DSIT survey in April, ENISA Threat Landscape in autumn and Sonatype in its annual cycle. Recheck each figure against the new edition rather than assuming the trend continued.

Metrics to track in your own programme

• Supplier coverage: share of critical suppliers with a current risk review (compare with DSIT's 15% and 48%).
• Third-party share of your incidents: share of your own incidents with supplier involvement (compare with DBIR's 48%).
• Blocked malicious packages: count of packages blocked at the repository proxy per month.
• Publishing token hygiene: share of package and CI publishing credentials that are short-lived or use trusted publishing.
• Supplier notification time: median time from a supplier's incident to your notification.

Practitioner checklist

• Cite every supply chain figure with publisher, report name and edition, and say what population it measures.
• Describe the DBIR 48% as third-party involvement, not as software supply chain attacks.
• Build a tiered inventory of suppliers with access to your network, data or production code.
• Add security requirements and two-way breach notification to supplier contracts.
• Route package installs through a proxy that blocks known malicious packages and pins versions.
• Generate SBOMs for your own software and request them from critical suppliers.
• Move package publishing and CI deployment to short-lived credentials and scoped secrets.
• Monitor supplier accounts, OAuth integrations and remote access for anomalous use.
• Rehearse a supplier compromise scenario at least annually.
• Recheck these figures when each publisher releases its next edition.

Standards and references

• Verizon: 2026 Data Breach Investigations Report Executive Summary
• Sonatype: 2026 State of the Software Supply Chain, Open Source Malware
• ENISA: Threat Landscape for Supply Chain Attacks
• ENISA: Threat Landscape 2026
• UK DSIT: Cyber Security Breaches Survey 2025/2026
• IBM: Cost of a Data Breach Report 2026
• IBM: Canada Cost of a Data Breach 2026 release
• MITRE ATT&CK: Supply Chain Compromise

Related NHI Mgmt Group resources: Software Supply Chain Security Guide · Third-Party Risk Management Guide · Top 10 Supply Chain Attacks · Data Breach Statistics Guide · Cybersecurity Statistics Guide