Supply Chain Attacks Surge in 2025, Exposing Thousands of Unnamed Victims A new report from cyber risk management firm Black Kite reveals a sharp escalation in supply chain attacks, with 136 major incidents in 2025 affecting 719 officially named companies and an estimated 26,000 additional unnamed victims. The average number of downstream victims per third-party breach has reached 5.28, more than double the 2024 figure (2.56) and the highest on record. This surge reflects a strategic shift by threat actors, who increasingly target shared platforms, centralized services, and high-dependency vendors to maximize disruption. The report highlights a systemic failure in traditional third-party risk management, with supply chain vulnerabilities now concentrated at critical connection points rather than isolated weak links. Ferhat Dikbiyik, Black Kite’s chief research and intelligence officer, warns that these risks have evolved from isolated incidents into a "systematic crisis," requiring organizations to adopt active intelligence and systematic awareness to track risk propagation. A persistent "silent window" exacerbates the problem: while the median time to detect an intrusion is 10 days, the median delay in public disclosure stretches to 73 days, leaving downstream customers exposed. Despite an average Cyber Grade of 90.27 (A) across nearly 200,000 monitored organizations, failure signals are widespread 53.77% have at least one critical vulnerability, and 23.34% have corporate credentials circulating on the dark web. Sector disparities are stark: manufacturing and professional services face high ransomware susceptibility and weak patch discipline, while finance maintains a more controlled risk profile. The report also underscores the threat to the top 50 vendors shared by the Forbes Global 2000, which serve as "master keys" for attackers targeting major enterprises. As reliance on third parties grows, so does the incentive for threat actors to exploit these high-value targets.