1 in 4 businesses hit by cyber attacks through their supply chain in the last year

New research from Databarracks finds almost half of organisations are knowingly working with suppliers with security concerns

LONDON, July 21, 2026 /PRNewswire/ -- One in four businesses (26%) have suffered a cyber incident that originated in their supply chain over the last year. This is despite organisations being highly aware of the risk facing them, with nearly half (48%) stating that they have continued working with suppliers despite known resilience or security concerns.

The findings come from the Data Health Check 2026, an annual survey of 500 IT decision-makers, which also revealed that in many cases organisations lack viable alternatives: more than a quarter (26%) identified "dependence on suppliers" as a main barrier to improving resilience.

Other key findings from the research include:

• Almost nine in ten businesses (89%) assess supplier resilience at onboarding, and the majority (61%) assess supplier resilience on an annual, quarterly or continuous basis.
• "Supply chain vulnerabilities" was also identified as one of the top three challenges facing organisations over the next five years, cited by 23% of respondents. This is behind only AI-driven cyber threats (46%) and ransomware (26%).
• Organisations that knowingly work with risky suppliers were more than 4 times as likely to experience a supplier-originated cyber incident. 43% of those organisations experienced an incident, compared with 10% of those that did not knowingly work with risky suppliers.

Commenting on the findings, Chris Butler, Resilience Director at Databarracks, said:

"This year's findings indicate that supply chain resilience remains a critical pain point for many businesses, which the majority are aware of and which continues to be exploited by attackers. When something goes wrong at a key supplier, the cascade effects can be profound for businesses throughout the chain.

"Despite good intentions around assessing supplier resilience, most companies don't fully understand the depth of complexity in their supply chains. Often they'll know who their core suppliers are, but beyond that, visibility drops away.

"The traditional approach to assessment has long been tick-box based, with compliance questionnaires growing longer every year. This approach creates a false sense of assurance rather than real resilience. 

"To truly manage your supply chain continuity, it's vital to actually get visibility of the situation. Business leaders need to treat supplier resilience as part of their own resilience, not somebody else's problem. It's a bit of a cliché but for good reason: you really need to treat your critical suppliers like you would your own business.

"Where there isn't a viable alternative and your existing suppliers don't have in-house business continuity skills, offer to help. Include your suppliers in your business continuity exercises and give them the chance to rehearse with you. It's important to practise the response to disruption together rather than in isolation. Doing this will benefit you in the long run."

Download the full report: Data Health Check 2026 – Databarracks

About Databarracks

Databarracks is the business and technology resilience expert.

In 2003, we launched one of the world's first managed Backup services to bring indestructible resilience to mission critical data. Today, we deliver award-winning Data Protection, Public Cloud and Business Resilience services, backed by 24/7 expert support.

The world's most resilient organisations trust us to protect their data, optimise their clouds and keep their operations running. When the worst happens, we guarantee their business continues.

We help our customers build resilience into every layer of their organisations, aligning people, processes and technology and proving recovery through regular testing. With prepared leadership, rehearsed plans and resilient technology, they're ready to respond to every modern business threat – from cyber attacks to system failures – and have full confidence in their continuity.

SOURCE Databarracks