Supply chain attack

A supply chain attack targets an organization indirectly by compromising a trusted supplier, software vendor or service provider, then using that trusted relationship to reach its customers.

Instead of attacking you head-on, criminals break into a company you rely on, such as a software maker, IT provider, payroll service or cloud platform. They might slip malicious code into a legitimate software update, abuse a provider's remote access tools or steal data stored on your behalf. Because the source is trusted, the attack can bypass normal suspicion.

Small and mid-sized Alberta businesses depend on many outside vendors, and an incident at one of them can affect you even if your own security is strong. You may still have obligations under PIPA if personal information you are responsible for is exposed through a supplier.

Practical tip: keep a list of vendors that have access to your systems or data, and ask key ones about their security practices, insurance and breach notification commitments. Limit each vendor's access to what they truly need, require multi-factor authentication on their accounts and remove access when the relationship ends.