Hack of Federal Agencies Shows Cyber Dangers to Supply Chains

A suspected Russian hack that is rippling across federal agencies and U.S. businesses highlights the far-reaching impacts of attacks on supply chains.

Customers of the software provider SolarWinds Inc. began unknowingly installing malware this spring through seemingly routine updates to a network-management tool, the company reported in a regulatory filing Monday. The updates included a weak point created by attackers and could have exposed nearly 18,000 of the Austin, Texas, company’s 300,000 customers.

While the fallout remains unclear, the monthslong campaign by the hackers underscores the complexities of vetting and defending sprawling supply chains, cybersecurity experts say. The hack comes as many companies and governments attempt to streamline their suppliers and as many vendors respond by offering more services, according to Jeff Pollard, a cyber analyst at Forrester Research Inc.