Report14 Sep 202612 min read
Anatomy of a breach: 72 hours inside a supply-chain attack
One poisoned software update reached 40 companies. Here's the timeline, hour by hour, and the three signals that stopped it.
Hour 0: the update
A widely used build tool shipped a minor version on a Friday evening. Buried in a dependency was 40 lines of code that waited six hours, then quietly read cloud credentials from the build environment.
Hour 9: the first strange login
At 03:12 a service account that had never left Frankfurt signed in from a residential IP in another continent. On its own, that's noise. Joined to the build event six hours earlier, it was a story.
“The alert wasn't the login. It was the path from a build server to a payroll bucket that nobody had ever drawn.”
Hour 31: containment
Tokens were revoked across all affected tenants in under four minutes. The attacker's infrastructure stayed up for two more days, talking to nobody.
What to do this week
- Pin build dependencies and verify signatures
- Give CI runners their own short-lived credentials
- Alert on any service account that changes country