Supply-chain social engineering

Supply-chain social engineering reaches a target by deceiving somebody the target trusts: a vendor, a contractor, or an outsourced help desk. The victim organisation may have strong internal controls and still be breached, because the attacker never confronts them directly.

This library records 3 cases. Two of them are among the largest disclosed losses documented here.

How the attack runs

1. Map the relationships. Suppliers, outsourced IT and facilities contractors are often publicly identifiable.
2. Choose the weaker party, usually smaller, with less mature security than the ultimate target.
3. Compromise or deceive that party, frequently by ordinary phishing or a telephone call.
4. Use legitimate trust, whether a vendor portal credential or an outsourced agent’s authority to reset access.
5. Move into the primary target, where the access is expected and therefore unremarkable.

Documented cases

• Clorox (2023, $380M): a caller posing as two different employees persuaded the outsourced Cognizant help desk to reset passwords and MFA.
• Target (2013, $292M): a mass-phishing infection at a small HVAC contractor produced vendor-portal credentials that were reused to pivot inward.
• Caesars Entertainment (2023, about $15M): breached through an outsourced IT support provider.

How it differs from related techniques

Invoice fraud imitates a vendor; this compromises one. Help-desk manipulation is the most common mechanism when support is outsourced. Credential harvesting is usually how the third party is breached first.

The control that would have stopped it

• Extend identity-verification standards to outsourced support contractually. Clorox’s controls were not the failure point; its provider’s were.
• Callback verification before any credential or MFA reset, performed against a record the caller cannot influence.
• Segment vendor access so a supplier portal cannot reach payment or customer systems, which is the specific lesson of Target.
• Least privilege for third parties, reviewed on a schedule rather than at onboarding only.
• Include suppliers in phishing awareness, since the initial compromise typically happens on their side.