Cyberattacks in supply chains: A multi-case study.

Area of Science:

• Cybersecurity
• Supply Chain Management
• Risk Management

Background:

• Supply chains face increasing threats from Supply Chain Cyberattacks (SCCAs) exploiting third-party vulnerabilities.
• Traditional defenses are insufficient against attacks that bypass perimeter security.

Purpose of the Study:

• Investigate SCCA propagation mechanisms, impacts, and governance.
• Analyze how SCCAs escalate and disrupt diverse sectors.
• Adapt the Supply Chain Cyber Security System (SCCSS) framework for process-oriented analysis.

Main Methods:

• Qualitative multi-case analysis of seven landmark SCCAs.
• Mapping attack vectors, escalation pathways, and recovery dynamics.
• Utilizing the SCCSS framework across IT, organizational, and supply chain subsystems.

Main Results:

• SCCAs often originate from third-party failures and propagate via Network Flattening, Alert Paralysis, Operational Coupling, and Relational Weaponization.
• Inter-system coordination failures amplify disruption; resilience requires proactive information sharing and organizational readiness.
• Synergy dependency highlights that external governance relies on internal controls; Points of Penetration (PoPs) are dynamic transmission mechanisms.

Conclusions:

• Cyber resilience in supply chains is conditionally interdependent across subsystems.
• SCCSS framework adapted into a process-oriented model for understanding cyber risk lifecycle.
• Actionable guidance provided for secure architecture, threat intelligence sharing, and supplier programs to enhance supply chain ecosystem resilience.