← ACARA Digital Technologies Years 9–10

Analysing a real supply chain attack

An attack where hackers breach one trusted supplier and use its software update to reach many victims. A case study traces the supplier, how the update spread and who was hit.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 78

Understanding Analysing a real supply chain attack in ACARA Digital Technologies Years 9–10

What it does: The victims are the supplier's customers downstream, so one breach can reach thousands of organisations. The update looked genuine and was signed, so it was installed automatically. Trust in the supplier let the attack spread. Compromising one supplier gives attackers a way into many networks at once, which is far less effort than attacking each one. The supplier makes the software. Customers receive it. Keeping the roles clear helps you analyse the attack. Even updates from trusted suppliers should be checked and monitored, because the supplier itself might be compromised.

Common mistakes: A single = stores the supplier name in a variable. == compares values, so supplier would never be created. It should be supplier = 'BuildCo'. An if statement must end with a colon. Without it Python gives a syntax error. It should be if supplier_breached:.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Analysing a real supply chain attack to a class →

This module's key terms are also in a printable crossword (Modules 828–859) and word search (Modules 810–859).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
In a supply chain attack case study, which company do attackers breach FIRST?
The trusted supplier whose software many customers useEvery customer one by one
Matches
attack = hit(each_customer)
↓
This shows attackers targeting each victim separately. A supply chain attack breaches one supplier and reaches many victims through it.
Applying
Meanings
Term
supply chain attack
Meaning
An attack where hackers breach one trusted supplier and use its software update to reach many victims. A case study traces the supplier, how the update spread and who was hit.
Practice
supplier ← "SolarWinds Orion"
Testing
Gaps
breached =
Check Answer
Spots
1supplier == 'BuildCo'
2update = 'v2.1 (infected)'

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Narwhal' badge — Unicorn Coder, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. In a supply chain attack case study, which company do attackers breach FIRST?
A. The trusted supplier whose software many customers use ✓
B. Every customer one by one
Attackers compromise one trusted supplier first, then use it to reach many victims at once.
2. How did the malicious code spread in the SolarWinds attack of 2020?
A. Hidden inside a normal-looking software update ✓
B. Through a fake email sent to every customer
Attackers slipped malicious code into a genuine Orion update, so customers installed it themselves.
3. Why did customers install the malicious update without suspicion?
A. It came from a supplier they already trusted ✓
B. They were forced to by the attackers
Trust in the supplier is what makes a poisoned update so effective.
4. Which is a better description of who was affected in a supply chain attack?
A. Only the supplier that was breached
B. Many organisations that used the supplier's software ✓
The supplier is the doorway. The customers who installed the update are the main victims.
5. When analysing a case study, which question traces how the update spread?
A. What colour was the supplier's logo?
B. How did the infected update reach customers? ✓
Tracing the spread means following the update from the supplier's systems to the customers who installed it.

Match the Pairs

supplier = "SolarWinds Orion" → The trusted supplier that was breached. Its software was the single entry point for the whole attack.
update.install() -> backdoor → Customers installed a real-looking update that secretly carried hidden malicious code.
Working out who was affected: every customer of the supplier who installed the bad update. → victims = supplier.customers
The update spread because customers trusted the supplier and installed it without suspicion. → if update.signed: install(update)
attack = hit(each_customer) → This shows attackers targeting each victim separately. A supply chain attack breaches one supplier and reaches many victims through it.
if from_supplier: skip_checks() → This trusts an update only because it comes from a known supplier. That blind trust is the weakness a supply chain attack exploits.

Key Term

supply chain attack
An attack where hackers breach one trusted supplier and use its software update to reach many victims. A case study traces the supplier, how the update spread and who was hit.

Fill in the Blanks

1. supplier = "SoftCo" breached = True print(supplier, breached)
Hint: Type the Boolean value that records the trusted supplier was hacked.
2. customers = ["A", "B", "C"] for c in customers: print("update sent to", c)
Hint: Type the keyword that repeats a step for every customer, like an update spreading to all of them.
3. victims = ["School", "Bank", "Council"] total = len(victims) print(total)
Hint: Type the built-in function that counts how many items are in a list, to show who was affected.
4. suppliers = 1 victims = 18000 ratio = victims / suppliers
Hint: Type the arithmetic operator that divides, showing how many victims one supplier reached.
5. def reach(customers): return len(customers) print(reach(["A", "B"]))
Hint: Type the keyword that sends a value back out of a function.

Spot the Error

Question 1
A supplier == 'BuildCo'
B update = 'v2.1 (infected)'
C victims = []
D victims.append('School A')
Line A — A single = stores the supplier name in a variable. == compares values, so supplier would never be created. It should be supplier = 'BuildCo'.
Question 2
A supplier_breached = True
B update_signed = True
C if supplier_breached
D print('Do not trust update')
Line C — An if statement must end with a colon. Without it Python gives a syntax error. It should be if supplier_breached:.
Question 3
A customers = ['A', 'B', 'C']
B for c in customers:
C prnt(c, 'got update')
Line C — The function name is misspelled, so Python cannot find prnt(). The loop should show each customer who received the update with print(c, 'got update').
Question 4
A def spread(update victims):
B for v in victims:
C v.install(update)
D return len(victims)
Line A — Parameters in a function definition must be separated by a comma. It should be def spread(update, victims):.
Question 5
A downloaded = 1000
B targeted = 10
C share = targeted / downloaded
D print(share / 100, '%')
Line D — To turn a fraction into a percentage you multiply by 100, not divide. It should be print(share * 100, '%'), which shows the share of victims who were targeted.

Student with a class code? Join your class →