Harden Supplier Controls After Mailbox Phish, CPU Research, and OT Intrusions

What happened

A US defense supplier reported that an employee was phished and an attacker accessed its Microsoft 365 mailbox. The intruder could view engineering documents, purchase orders and potentially export-controlled files; the company discovered and secured the account and reported containment actions publicly. Watch whether suppliers provide preserved logs and forensic artifacts and whether contracts already permit rapid evidence access

Why the category manager should care

Require phishing-resistant authentication and contractual rights to preserved logs and forensic artifacts because supplier-managed mailboxes are a high-impact attack path

Key facts

• Attacker accessed Microsoft 365 mailbox contents
• Email, attachments, purchase orders and engineering files were exposed
• Company reported discovery and containment actions in a public filing

What happened

MIT researchers disclosed TONTOU, a speculative-execution attack that can re-poison branch predictors and bypass Spectre mitigations on recent Intel and AMD CPUs. They demonstrated a full exploit on AMD Zen 2 and partial results on other families, with exploit attempts taking significant lab time but proving practicality under certain conditions. Procurement should watch cloud and host vendor patching, processor inventories, and public exploit activity before changing hosting assumptions

Why the category manager should care

Ask providers for processor-family inventories and documented mitigation timelines because microarchitectural exploits need host and firmware fixes

Key facts

• End-to-end exploit demonstrated on AMD Zen 2
• Tests included Intel Cascade Lake Refresh, Arrow Lake and AMD Zen 4
• Demo exploit attempts were non-trivial in time and conditions

What happened

Former NSA chief Paul Nakasone and security researchers warned that water-system PLCs should not be internet-connected after suspected intrusions affecting sensor and pump controls. The FBI is investigating attacks that targeted operational-technology devices across multiple facilities, and underfunded municipalities often lack cybersecurity staff. Procurement should require attestations and verified segmentation before accepting suppliers or partners with internet-facing OT

Why the category manager should care

Require suppliers and municipal partners to attest that PLCs are not directly internet-exposed and to provide segmentation evidence because connectivity equals risk

Key facts

• FBI investigation into attacks on operational-technology devices
• PLCs targeted to monitor tank levels and control pumps
• Multiple US water systems reported intrusions

What happened

A ransomware tracker reported a month-over-month increase in recorded incidents, with finance, tech, pharmaceutical and medical-billing sectors seeing notable rises. The tracker’s verification varies by incident, so public counts are directional rather than definitive. Procurement should prioritize verified backup integrity and recovery SLAs with suppliers in the most-affected sectors

Why the category manager should care

Insist on tested backups, recovery SLAs and payment-redirection controls from suppliers in high-target sectors because ransom events can cascade into buyer outages

Key facts

• Recorded ransomware incidents increased in the recent month
• Finance, tech, pharma and medical-billing sectors showed larger upticks
• Only a share of tracker claims are confirmed by victim reports

What happened

OpenAI announced stricter security controls for an internal high-capability model (Astra), including isolated test environments, restricted network/tool access, and enhanced monitoring, and said it will pause testing where controls are absent. This is a vendor-level pledge rather than an industry standard. Procurement can reuse the controls as template contract language but should require independent verification and audit rights

Why the category manager should care

Adapt OpenAI’s internal controls (isolation, restricted tool access, monitoring) into supplier obligations for AI engagements, with audit and verification clauses

Key facts

• Commitment to isolated testing environments and restricted tool/network access
• Promise to pause testing where controls are absent
• Intended guidance for third-party testing partners