Supply Chain Compromise
0 confirmed incidents.
VERIS: hacking:Exploit vulnMITRE ATT&CK: T1195 (Supply Chain Compromise)T1199 (Trusted Relationship)
MITRE ATT&CK technique names and ids on this page are reproduced and distributed with the permission of The MITRE Corporation. © 2015–2026, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
Supply chain compromise covers an attack that reaches its ultimate target through a vendor, software update or service provider rather than attacking the target directly. It maps to two MITRE ATT&CK techniques: T1195 (Supply Chain Compromise), tampering with a product or update before it reaches the victim, and T1199 (Trusted Relationship), abusing legitimate access a vendor or partner already has into the victim's network. An incident classified this way on Breach Census may show the vendor that was actually compromised, the organizations downstream of it that were exposed as a result, or both, depending on what the source document reports.
No confirmed incidents currently carry this attack-type classification.
Questions and answers
How many confirmed incidents are classified as Supply Chain Compromise on Breach Census?
0 confirmed incidents are currently classified as Supply Chain Compromise.
Which MITRE ATT&CK techniques does the Supply Chain Compromise classification cover?
This classification maps to MITRE ATT&CK techniques T1195 (Supply Chain Compromise), T1199 (Trusted Relationship).
What counts as a confirmed incident for the Supply Chain Compromise classification?
An incident counts here once it carries the Supply Chain Compromise attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.