SolarWinds, 2020. Attackers slipped malicious code into updates of a popular network-monitoring tool, which was then shipped to about 18,000 organizations, including US government agencies. Few records were lost, but it made software supply-chain security a board topic.
MOVEit, 2023. A flaw in a file-transfer product was exploited across thousands of organizations at once — more than 95 million people affected, most of whom had never heard of the software because a supplier used it.
Marriott, 2018. When Marriott bought Starwood, it also bought an intrusion that had been running since 2014. About 383 million guest records were exposed.
The common thread, as one security timeline puts it: trust given to something nobody examined — a library, an update channel, a vendor, an acquired network.
What it means for your business
- Keep a list of your software components and of every third party with access to your systems.
- Ask critical suppliers for security evidence — and verify it.
- In any acquisition, assume compromise until you have checked.
How MTH can help: Our Security Operations service includes supplier and supply-chain risk assessments and pre-integration threat hunting for mergers.
This briefing is original commentary by MTH based on public reporting; figures are as reported by the sources named above and may be revised over time.
