Supply chain security spans software suppliers, service providers, contractors and other third parties whose access can extend an organization’s attack surface. The figures below separate supply-chain-specific evidence from broader cybersecurity indicators, while keeping each population, period, geography and limitation explicit.
Key Supply Chain Security Statistics
The most broadly useful figures include:
- 24 supply-chain incidents were identified and analyzed by ENISA from January 2020 through early July 2021 in an international curated study sample.
- Supply-chain attacks were forecast to be four times as numerous in 2021 as in 2020 in ENISA’s historical 2021 assessment of global attacks.
- 30% of breaches involved a third party in Verizon’s global 2025 DBIR dataset covering November 1, 2023, through October 31, 2024.
- 47% of surveyed European Union organizations cited supply-chain and third-party compromise as a future concern in ENISA’s 2025 study.
- 37% of surveyed European Union organizations called supply-chain risk management a key implementation difficulty in ENISA’s 2025 study.
- 66% of attacks in ENISA’s 2020–early July 2021 sample focused on supplier code.
- 62% of attacks in ENISA’s sample used malware as the attack technique.
- 43% of United Kingdom businesses reported a cyber breach or attack during the previous 12 months in the 2025/26 survey.
- 69% of United Kingdom large businesses reported a cyber breach or attack during the previous 12 months in that survey.
- 15% of United Kingdom businesses formally reviewed immediate-supplier cyber risks in the 2025/26 survey.
- 6% of United Kingdom businesses formally reviewed wider-supply-chain cyber risks in the 2025/26 survey.
- 11% of United Kingdom businesses required suppliers to hold any standards or accreditations in the 2025/26 survey.
- 77% of European Union operators of essential services and digital service providers had a third-party supply-chain cybersecurity risk-management policy in 2023.
- $4.88 million was the global average cost of a data breach in IBM’s 2024 study.
- 194 days was the global average time to identify a breach in IBM’s 2024 study.
- 19% of United Kingdom businesses reported any negative outcome from a cyber breach or attack during the previous 12 months in the 2025/26 survey.
Contents
- Attack scale and third-party exposure
- Attack techniques and entry points
- Business size and sector
- Adoption, reviews and supplier standards
- Costs, detection and outcomes
Supply Chain Security Statistics: Attack Scale and Third-Party Exposure
ENISA’s Threat Landscape for Supply Chain Attacks identified and analyzed 24 incidents discovered from January 2020 through early July 2021. The study was an international curated sample, not a census of all attacks, and ENISA warned that misclassification can distort trend analysis. ENISA, Threat Landscape for Supply Chain Attacks
ENISA also estimated in 2021 that supply-chain attacks would be four times as numerous in 2021 as in 2020. This is a historical forecast, not a subsequently verified count.
Verizon’s 2025 Data Breach Investigations Report provides a much larger but broader contributed dataset: more than 22,000 security incidents and 12,195 confirmed data breaches for organizations contributing anonymized global data between November 1, 2023, and October 31, 2024. Third-party involvement appeared in 30% of breaches, double the prior reported share; this is Verizon’s classification and is not a census of worldwide breaches. Verizon, 2025 Data Breach Investigations Report
| Measure | Result | Population and period |
|---|---|---|
| ENISA incident sample | 24 incidents | International incidents, January 2020–early July 2021 |
| Verizon security incidents | More than 22,000 | Global contributing organizations, November 1, 2023–October 31, 2024 |
| Verizon confirmed breaches | 12,195 | Global DBIR dataset, same period |
| Verizon breaches with third-party involvement | 30% | Global DBIR dataset, same period |
ENISA’s 2025 EU organization study found supply-chain and third-party compromise was the second-most frequently cited future concern, at 47%. The same study reported that 47% cited supply-chain attacks as a concern looking ahead; these overlapping measures reflect perceived future concern, not observed incident prevalence. ENISA, What’s Driving Cybersecurity Investments and where lie the challenges?
The study also reported that 37% considered supply-chain risk management a key implementation difficulty. Separately, ENISA reported that 74% of EU Member States had defined supply-chain security measures in national legislation for essential and important entities in an assessment reported in the 2024 State of Cybersecurity; legislative existence does not show implementation effectiveness.
Supply Chain Security Data on Attack Techniques and Entry Points
ENISA’s selected incident sample shows why supplier code and malware deserve separate attention. Supplier code was the focus of 66% of analyzed attacks, while malware was the technique in 62%; both shares are based on 24 incidents and ENISA’s study-specific taxonomy. ENISA, Threat Landscape for Supply Chain Attacks
Broader breach data helps contextualize entry points but must not be relabeled as supply-chain-only evidence. In Verizon’s 2025 DBIR, credential abuse was the initial attack vector in 22% of breaches and vulnerability exploitation in 20%; vulnerability exploitation increased 34% year over year.
Ransomware appeared in 44% of breaches and rose 37% from the prior year, while the median reported ransom payment was $115,000. Verizon, 2025 Data Breach Investigations Report
| Technique or vector | Result | Scope |
|---|---|---|
| Supplier code | 66% | ENISA supply-chain incident sample, January 2020–early July 2021 |
| Malware | 62% | ENISA supply-chain incident sample, same period |
| Credential abuse | 22% | Verizon breaches, November 1, 2023–October 31, 2024 |
| Vulnerability exploitation | 20% | Verizon breaches, same period |
| Ransomware | 44% | Verizon breaches, same period |
ENISA reported that 50% of EU organizations had difficulty with timely patching in its 2025 study, and 28% took more than three months to patch critical vulnerabilities. Among EU SMEs, 51% reported patching as a persistent challenge; these are self-reported difficulties, not measured patch-compliance rates. ENISA, What’s Driving Cybersecurity Investments and where lie the challenges?
Supply Chain Security Statistics by Business Size and Sector
The United Kingdom’s 2025/26 Cyber security breaches survey found that 43% of businesses reported any cyber breach or attack in the previous 12 months, compared with 28% of registered charities. The survey extrapolated those reported incidents to approximately 612,000 businesses and 57,000 charities; these are survey estimates with sampling error, and hidden or unidentified attacks may mean underestimation. UK Government, Cyber security breaches survey 2025/2026
| UK population | Reported breach or attack, previous 12 months |
|---|---|
| Micro businesses | 42% |
| Small businesses | 46% |
| Medium businesses | 65% |
| Large businesses | 69% |
| Information and communication businesses | 63% |
| Professional, scientific and technical businesses | 54% |
| Food or hospitality businesses | 33% |
| Retail or wholesale businesses | 31% |
The size pattern is pronounced: identified and reported prevalence ranged from 42% among micro businesses to 69% among large businesses. The sector figures are UK survey estimates, not supply-chain-origin rates; lower small-business prevalence may partly reflect weaker monitoring.
Supply Chain Security Adoption, Reviews and Supplier Standards
Only 15% of UK businesses formally reviewed cyber risks from immediate suppliers in the 2025/26 survey, and only 6% reviewed risks in their wider supply chain. Among charities, the corresponding figures were 9% and 4%; formal review is self-reported and does not measure review quality. UK Government, Cyber security breaches survey 2025/2026
| UK business size | Immediate-supplier review | Wider-supply-chain review |
|---|---|---|
| Micro businesses | 12% | 5% |
| Large businesses | 48% | 24% |
Supplier requirements were also uncommon. Only 11% of UK businesses required suppliers to hold any standards or accreditations, including 3% requiring Cyber Essentials specifically; among large businesses, the shares were 41% and 26%, respectively.
A requirement does not establish supplier compliance or effective controls.
In the EU, ENISA reported that 77% of operators of essential services and digital service providers had a third-party supply-chain cybersecurity risk-management policy in 2023. Policy presence does not measure implementation quality or outcomes.
Among high-income UK charities, immediate-supplier risk reviews increased from 21% in 2024/25 to 31% in 2025/26, a subgroup survey comparison. ENISA, Threat Landscape for Supply Chain Attacks; UK Government, Cyber security breaches survey 2025/2026
Supply Chain Security Costs, Detection and Business Outcomes
IBM’s 2024 study estimated the global average cost of a data breach at $4.88 million, up from $4.45 million in the prior study. Financial-industry organizations averaged $6.08 million per breach, 22% above IBM’s global average, while breaches involving 50 million or more records averaged $375 million in IBM’s financial and healthcare comparisons; none of these are supply-chain-only costs. IBM, Cost of a data breach 2024: Financial industry
| IBM measure | Result | Scope |
|---|---|---|
| Global average breach cost | $4.88 million | Global organizations, 2024 study |
| Financial-industry average | $6.08 million | Financial enterprises, 2024 study |
| 50-million-plus-record breach | $375 million | Financial and healthcare comparison, 2024 study |
| Global time to identify | 194 days | Global organizations, 2024 study |
| Global time to contain | 64 days | Global organizations, 2024 study |
In IBM’s financial-industry analysis, malicious attacks accounted for 51% of breach causes, IT failures for 25%, and human error for 24%. Financial organizations averaged 168 days to identify a breach and 51 days to contain it, compared with IBM’s global averages of 194 and 64 days; the financial-sector annual average breach cost was $5.72 million in 2021, $5.97 million in 2022 and $5.9 million in 2023. IBM, Cost of a data breach 2024: Financial industry
The UK survey adds a different outcome lens. During the previous 12 months, 19% of businesses and 11% of charities reported any negative outcome from a cyber breach or attack; the figures cover identified incidents and self-reported outcomes. UK Government, Cyber security breaches survey 2025/2026
For the most disruptive incident, the UK survey’s median perceived cost was £0 for businesses and charities overall, reflecting a skewed distribution rather than an absence of material losses. The 95th-percentile perceived cost was £4,000 for all businesses and £10,000 for medium and large businesses; these are incident-level perceived costs, not total annual losses.
Finally, phishing was the most prevalent attack type among 38% of UK businesses and 25% of charities in the 2025/26 survey. That measure is a broad cybersecurity indicator, not evidence that the attack originated in a supply chain. UK Government, Cyber security breaches survey 2025/2026