Global rise in industrialized supply chain cyber attacks

Cybersecurity trends in 2026 show a significant rise in supply chain attacks and the emergence of a ‘credential relay economy’. Reports indicate that third-party involvement in confirmed breaches has reached 48 percent, a 60 percent increase year-over-year. Breaches originating from infected suppliers take an average of 258 days to identify and contain, which is longer than the global average.

Specific incidents include a breach at Telus Digital involving harvested Google Cloud Platform credentials and a supply chain poisoning attack against the LiteLLM API gateway that exposed approximately 195TB of password data. In response to such activities, Australian police arrested two alleged members of TeamPCP, a group linked to poisoning attacks against code hosting platforms.

As the threat landscape evolves, attackers are increasingly targeting trusted software providers, cloud platforms, and managed services to gain simultaneous access to multiple organizations. Recent data indicates a shift toward ‘industrialized’ supply-chain attacks, with reported incidents involving managed service providers (MSPs) and software ecosystems rising by 168 percent year-over-year. Attackers are utilizing SaaS platforms, open-source repositories, and MSP ecosystems as repeatable production lines to distribute malware through hijacked GitHub Actions, malicious npm packages, and trojanized SaaS plugins.

To counter these sophisticated AI-driven maneuvers, new defensive strategies like ‘Agentic Collaboration Security’ have been introduced. These focus on intent-based detection to identify malicious activity hidden within legitimate business workflows and address risks posed by AI agents that interact directly with data, potentially bypassing traditional application boundaries.