The 53 breaches and supply-chain attacks of the last 30 days, 21 confirmed by the company itself, grouped by the mistake that let them happen. The check under each cause tells you whether you were hit.
Last 30 days, share of 53
Your own code was fine. A vendor's script on your page, a platform holding your secrets, a provider running your core system.
Were you hit
List the third-party scripts your pages load (tag managers, RUM, analytics, chat widgets) and whether each has Subresource Integrity or a Content Security Policy that would stop a swapped file. List every hosted platform that holds a secret of yours and which secrets. If one of them were breached tonight: which keys would you rotate, and do you know how. For vendors that run a core system for you: have they sent a breach notice this month, and did you act on it.
The attacker did not break into the victim. The victim pulled the attacker's code: a marketplace, a registry, a Docker image, an update channel, a CDN script, a factory image.
Were you hit
Install scripts off where you can (npm ignore-scripts, wheels only, no native builds in CI) and the rest allow-listed. Lock files pin exact versions and CI installs from the lock, never latest. Images pinned by digest. Editor extensions: which marketplace, auto-update on or off, which have shell or SSH access. Anything that pulls code at runtime: list the hosts it fetches from. Coding agents that read issues or PRs: can they run commands from that text, and with which credentials.
A token, key, password or app secret leaked or was guessed, and nothing noticed it was still valid: no rotation, no expiry, no sign-in review.
Were you hit
List every long-lived credential you hold: GitHub PATs and deploy keys, cloud IAM keys, OAuth app and service-principal secrets, CI secrets, database passwords. For each: when it was last rotated, where it is used, whether you would notice someone else using it. Anything older than 90 days or without an owner gets rotated this week. Pull 30 days of sign-in logs for service accounts and look for new IPs, ASNs and scopes. Set expiry on every token that supports it.
A real company's email system or data was used to send you convincing messages.
Were you hit
Treat messages from a breached vendor as suspect until they confirm on their status page; verify payment and credential requests out of band.
A flaw with a public advisory, exploited before the fix was applied.
Were you hit
This is what the rest of InfraStack does: your stack against every advisory, with the fix version, on your board.
The victim has not said how it happened. Pages update when they do.
Causes are assigned by a model from each record’s sources, two fields per record: how the attacker got in, and how it reached others. “Confirmed by” lists the companies whose own page, status post or filing says it happened. The victim’s own words win where they exist.
A person was tricked
A fake login page, a call from the help desk, a job offer with a test project.
Were you hit
Phishing-resistant second factors (passkeys, hardware keys) on the accounts that matter; a help-desk process that never resets a factor on a phone call alone; code from recruiters and partners runs in a sandbox first.