Supply chain attacks and credential relay rise in 2026

Recent cybersecurity reports highlight a significant rise in supply chain attacks and credential relay tactics. According to the 2026 Verizon Data Breach Investigations Report, third-party involvement in confirmed breaches has reached 48 percent, representing a 60 percent increase year-over-year.

IBM's 2026 report notes that breaches originating from an infected supplier take an average of 258 days to identify and contain, which is eleven days longer than the global average. This delay is often driven by the ‘credential relay economy,’ where stolen credentials from one vendor are replayed against that vendor's customers.

Specific incidents illustrate these risks. In March 2026, Telus Digital suffered a major breach where attackers used Google Cloud Platform credentials harvested from a previous Salesloft Drift breach to access data. Additionally, a supply chain poisoning attack against the LiteLLM API gateway impacted approximately 2,500 organizations, exposing roughly 195TB of password data within a 40-minute window. In response to such activities, Australian police have arrested two alleged members of TeamPCP, a group linked to poisoning attacks against various code hosting platforms and APIs.