September 2025 Supply Chain Attacks: Lessons from Jaguar Land Rover, Bridgestone and Software Repositories

September 2025 Supply Chain Attacks: Lessons from Jaguar Land Rover, Bridgestone and Software Repositories

September 2025 reminded businesses why supply chain security is mission-critical. In a single month, we saw high-profile attacks across the automotive industry and open-source ecosystems. Jaguar Land Rover (JLR) and Stellantis were forced to halt manufacturing after hackers breached their networks and disrupted production. The attack, claimed by a group called "Scattered Lapsus$ Hunters", also resulted in data theft from JLR’s supplier portal. Around the same time, tyre giant Bridgestone grappled with operational disruptions as ransomware paralysed its plants.

The open-source community was not spared. In August/September, a supply chain attack dubbed "S1ngularity" compromised 2,180 GitHub accounts and poisoned more than 7,200 repositories to harvest credentials. Another campaign called "GhostAction" exfiltrated over 3,325 secrets from compromised repositories. Attackers even hijacked multiple npm packages, briefly causing disruption to around 10% of cloud environments.

September 2025 reminded businesses why supply chain security is mission-critical. In a single month, we saw high-profile attacks across the automotive industry and open-source ecosystems. Jaguar Land Rover (JLR) and Stellantis were forced to halt manufacturing after hackers breached their networks and disrupted production. The attack, claimed by a group called "Scattered Lapsus$ Hunters", also resulted in data theft from JLR’s supplier portal. Around the same time, tyre giant Bridgestone grappled with operational disruptions as ransomware paralysed its plants.

The open-source community was not spared. In August/September, a supply chain attack dubbed “S1ngularity” compromised 2,180 GitHub accounts and poisoned more than 7,200 repositories to harvest credentials. Another campaign called “GhostAction” exfiltrated over 3,325 secrets from compromised repositories. Attackers even hijacked multiple npm packages, briefly causing disruption to around 10% of cloud environments.

Supply chain attacks exploit trust relationships between companies, suppliers, and open-source communities. By abusing code repositories, CI/CD pipelines, and vendor portals, threat actors can infiltrate organisations without directly breaching their networks. Once inside, they deploy ransomware, steal intellectual property, or implant backdoors. For manufacturers like JLR and Bridgestone, the downtime costs can run into hundreds of millions, not to mention reputation damage and regulatory fines.

To reduce the risk of supply chain vulnerabilities, organisations should:

- Audit your suppliers and vendors: Conduct security assessments of partners and insist on robust controls and incident reporting. Attackers often exploit weak links in the chain.
- Implement code-signing and package verification: Use digital signatures to ensure software packages and updates are authentic. Tools like SLSA and SBOMs help track dependencies and detect tampering.
- Segment and monitor your network: Limit supplier access to only what is necessary, and deploy intrusion detection to spot unusual activity. Misconfiguration in access controls can expose your environment to lateral movement.
- Harden CI/CD pipelines: Use least-privileged credentials, rotate secrets regularly, and isolate build servers. Attackers often target build scripts to inject malicious code execution.
- Educate your teams: Developers and supply chain managers need training on secure coding, package management, and phishing defence. Terra System Labs’ security awareness training covers topics like shadow IT and deepfake impersonation to help staff spot early warning signs.
- Have an incident response plan: Rapid containment and communication are critical when an attack strikes. Run tabletop exercises to rehearse roles and reduce chaos during a real incident.

Maintenance of supply chain security is an ongoing process. Terra System Labs offers third-party risk assessments, penetration testing, and purple team engagements to uncover hidden gaps. By proactively addressing vulnerabilities and strengthening partnerships, your busniess can reduce the likelihood of becoming the next headline in 2025’s cyber onslaught.