Attackers entered through credentials issued to a refrigeration and HVAC contractor with remote access to Target's network, and moved from there to the payment systems. Around 40 million card records and 70 million customer records were taken. The vendor had no role in payments and no reason to be near them.

One certificate authority quietly acquired another and did not disclose it, in breach of the browser root program rules that require exactly that disclosure. Backdated certificates and misissuance followed. Mozilla, Google and Apple each removed trust in both, treating the concealed change of control as the primary offense.

An author removed an eleven-line package from the public registry after a naming dispute, and thousands of builds broke worldwide within hours. Nothing was compromised and nobody was attacked. It established that a component nobody had chosen deliberately could still stop a great deal of work.

The update channel of a Ukrainian tax accounting product was used to distribute destructive malware to every organization that ran it, and it spread from there through connected networks. Merck and Maersk were among the companies whose operations were halted for weeks. Merck's insurance claim over the loss ran to roughly 1.4 billion dollars and took years of litigation to resolve.

A backdoored build of a widely used utility was signed with the vendor's own certificate and distributed through the vendor's own download infrastructure. Around 2.27 million users installed it before the compromise was found. The vendor had been acquired shortly before, but the evidence points to an intrusion into the build environment rather than to the transaction.

A chatbot script supplied by a third party was running on payment pages. The supplier's infrastructure was compromised rather than the retailer's, and up to nine million customers were affected. The regulator fined the retailer, which disputed responsibility for a script it had not written.

Twenty-two lines of script were added to code the airline itself hosted, and payment details for roughly 429,000 people were taken over three weeks. This was a first-party compromise using the same techniques, not a third-party supplier failure, and the two are frequently and wrongly grouped together. The regulator fined the airline 20 million pounds.

A maintainer who had stepped back from a package downloaded millions of times a week was approached by a stranger offering to help, and granted publishing rights. Two months later a dependency added by the new maintainer carried a payload targeting a specific cryptocurrency wallet. It was found three months after that, by a developer reading the code.

A browser extension with around two million users was acquired by an analytics company in 2017. Eighteen months later a researcher documented that it was sending the full browsing history of everyone who had it installed back to the new owner. Both Chrome and Firefox removed it within days of the report.

The developer of two ad-blocking extensions sold them in October 2020 and said so publicly at the time. Within about two weeks the new owners had pushed an update that collected user data, and the extensions were pulled. Where the Polyfill.io interval was four months and the xz-utils interval was twenty-eight, this one was a fortnight.

A vendor update utility, correctly signed and served from the vendor's own servers, delivered a backdoor to a large number of machines. Researchers found that the payload checked each machine against a hard-coded list of several hundred network addresses and did nothing on any of the rest. Mass distribution was the delivery method for a very small number of intended targets.

Attackers reached the build pipeline for a network management product and inserted code into a signed release. Fewer than 18,000 customers are believed to have installed the affected version, and a much smaller number were pursued further. It was found by a security firm investigating an intrusion into its own systems, not by any customer.

A browser extension with more than two million installations was sold by its developer to a buyer whose identity was not disclosed. The functionality did not change and no update looked unusual. Malicious behavior appeared five months later, and the extension was removed and remotely disabled on users' machines the following February.

Ransomware was pushed through the remote management platform that managed service providers use to administer their clients. Up to around 1,500 downstream businesses were affected, most of which had never heard of the platform. They were exposed through their provider's tooling rather than through anything they ran themselves.

A flaw in a Java logging library present in an enormous number of applications became trivially exploitable, and organizations spent weeks trying to establish where the library even was. Most could not answer the question quickly. The scramble was not about the flaw so much as about the absence of any inventory to check it against.

An employee installed a trojanized copy of unrelated trading software on a personal machine. The attackers used the credentials obtained there to reach the company's own build environment and trojanize its desktop application, which had over 600,000 customer organizations. It is the clearest documented case of one supply chain compromise being used to stage another.

A flaw in a managed file transfer product was used to extract data from the organizations running it and from the many more whose data those organizations held. Trackers recorded well over 2,000 affected organizations and tens of millions of individuals. A large share of those individuals had no relationship with the software or with the companies operating it.

An identity made its first ordinary contribution to a core compression library in October 2021, was given a larger role in mid-2022 after a sustained campaign of apparently unrelated voices pressed the sole maintainer to accept help, and inserted a backdoor into the build scripts in February 2024. Twenty-eight months elapsed with no fraudulent step to detect, because every step was genuine until the last one. It was found by accident, by an engineer investigating an unrelated performance problem, and it had reached testing and rolling distributions rather than stable releases.

A widely used script service had its domain and repository sold in February 2024 to a company registered in China, and developers raised the change in a public repository issue that same month. Malicious redirects were independently documented in late June, affecting more than 100,000 sites. The acquirer was sanctioned by the United States Treasury in May 2025 over an unrelated fraud operation.

A faulty content update to a security agent caused roughly 8.5 million Windows machines to fail to boot, according to Microsoft. Nothing was compromised and nobody attacked anything. Airlines, hospitals and banks stopped working because they all depended on the same component, which is what concentration looks like when it fails by accident.

A stolen access token was used to rewrite the version tags of a widely used continuous integration action so that they pointed at code which printed build secrets into publicly readable logs. Around 23,000 repositories referenced the action. The token had been obtained some months earlier through an unrelated project.

Stolen publishing credentials were used to add code to package releases that then harvested credentials from the machines that installed them, and used those to publish further affected releases. It is the first documented case of a self-propagating compromise in a major package registry. More than a hundred packages were affected in the first wave.