Press Room
Prosegur Cybersecurity reports that 22.5% of security breaches in Spain in 2025 involved third parties or suppliers
ENISA identifies third-party and supply chain attacks as the second most significant future concern for European organisations.
Madrid, 14 October 2026 – Prosegur Cybersecurity, the cybersecurity business unit integrated within Prosegur Security, has published a report highlighting that 22.5% of the security breaches recorded in Spain during 2025 involved third parties or suppliers. The growing interdependence between organisations, technology providers and industrial systems has made supply chain attacks one of the leading cybersecurity challenges for strategic sectors such as the food industry, where the digitalisation of processes increases exposure to this type of threat. This exposure is now being compounded by artificial intelligence (AI), which enables attackers to operate faster and at greater scale.
The digitalisation of the food industry has increased the interconnection between production, logistics, refrigeration and technology provider systems. While this evolution improves operational efficiency, it also broadens the potential exposure to cybersecurity incidents with a direct impact on business operations.
A recent example of this trend has emerged in France, where a cybersecurity incident affected the Danish company Danfoss, a supplier of refrigeration systems for major food retail chains, impacting more than 400 supermarkets. The case illustrates how the growing interconnectivity between technology suppliers and food supply chain operators can extend the consequences of an incident well beyond the organisation initially affected.
The incident reflects an increasingly significant trend: the compromise of any connected supplier can amplify the scope of an attack and even transfer its effects from technological systems to physical operations. In this context, Prosegur Cybersecurity’s analyses show that supply chain attacks continue to gain prominence within the threat landscape, having doubled during 2025 compared with the previous year and reaching an average cost of €4.33 million per incident.
Supply Chain in the Crosshairs
Attacks targeting third parties have become one of the primary entry points for cybercriminals. According to various industry analyses, nearly half of supply chain-related incidents begin with the compromise of credentials belonging to external suppliers or service providers, subsequently enabling attackers to extend access to the targeted organisation.
This trend coincides with growing interest in operational technology (OT) environments and connected systems involved in production and logistics processes. Data published by INCIBE reflects this evolution: during 2025, it managed 122,223 cybersecurity incidents, 26% more than the previous year, and identified 237,028 vulnerable systems. In addition, 85% of systems infected through networks of compromised devices were associated with smart devices and connected equipment.
Accelerating third-party attacks
AI is changing the economics of cyberattacks. Prosegur Cybersecurity warns that these tools enable the automated identification of suppliers and dependencies, faster discovery and exploitation of vulnerabilities, and the creation of more convincing social engineering messages aimed at employees of service providers, who often hold access credentials to their customers’ environments.
Data from the first half of 2026 points in this direction. According to Forescout Research, 37,137 vulnerabilities were disclosed, representing a 51% increase compared with the same period the previous year. The pace accelerated from March onwards, a trend the company associates with AI-assisted vulnerability discovery. Meanwhile, Wiz Research reports that notable supply chain attacks more than doubled during the first half of the year, while activity targeting AI infrastructure approximately doubled compared with the second half of 2025. Many of these campaigns also reinforced one another, with compromised packages stealing developer credentials that were later used in subsequent attacks. Phoenix Security, which analyses malicious packages, estimates that the volume recorded during the first half of 2026 was 4.5 times higher than the total for the whole of 2025.
This reality helps explain why, according to ENISA’s NIS Investments 2025 report, 90% of European organisations already apply specific supplier oversight measures. Even so, attacks targeting third parties and supply chains remain the second greatest future concern for organisations across Europe.
Carlos A. Fernández, Head of xMDR Platform at Prosegur Cybersecurity, stated: “Cases such as the recent incident in France demonstrate the extent to which an organisation’s resilience is linked to the security of its entire ecosystem. The growing connectivity between suppliers, technology platforms and industrial systems makes it essential to increase visibility across critical dependencies and strengthen detection and response capabilities in order to anticipate potential supply chain compromises.”
In an increasingly interconnected environment, with attackers benefiting from the capabilities of AI, Prosegur Cybersecurity considers it a priority to enhance visibility across suppliers, critical assets and technology dependencies. To achieve this, the company recommends that organisations strengthen third-party access management, monitor critical integrations and maintain continuous visibility over connected systems. It is also essential to advance towards Zero Trust security models, accelerate patch management and reinforce employee and supplier training against emerging AI-driven social engineering techniques, supported by advanced detection and response capabilities.