Compromised email accounts behind 71% of cyber incidents investigated by Sharp, highlighting growing supply chain risk
New analysis of real-world cyber incidents investigated by Sharp highlights the risk a compromised account can have on businesses and the wider supply chain.
By analysing security operations data across 99 incidents and 10,516 alerts between August 2025 and September 2026, Sharp UK found that:
· 71% of incidents investigated started with a compromised email account
· Only 2% of incidents were ransomware-related
· Nearly half (43%) of account takeover attempts happen outside of business hours
· The peak time for account takeover alerts is between 3pm and 7pm
The findings come as the Government’s latest cyber security breaches survey found 43% of businesses had a breach or attack in the last year. Cyber-attacks on businesses are also becoming more widely reported, with ASOS, TFG London and H&M investigating incidents or claims in the past month alone.
Every business is a link in a long chain, and if an account is hijacked, the whole supply chain is at risk. The Government’s 2025/2026 Cyber Security Breaches Survey also found that only 15% of businesses review their immediate suppliers’ cyber risk, and only 6% look at the wider supply chain.
This reinforces the need for businesses to have open conversations with suppliers about cyber security, while regularly reviewing and monitoring the risks that exist across their supply chain. With Sharp reporting that nearly half of account takeover attempts happen outside business hours, a takeover attempt caught during the work day can just mean a password reset, but if found on Monday after a weekend, it could mean attackers have access to internal correspondence for days.
Tyron Raubenheimer, Head of Security and Cloud Technologies at Sharp UK, comments on this supply chain cybersecurity issue and what businesses should be doing to protect themselves: “No business operates in isolation.
“Every organisation is part of an interconnected ecosystem of suppliers, partners and customers built on trust, and cyber criminals are increasingly exploiting those trusted relationships as a route into their targets. As supply chains become more digitally connected, organisations need greater visibility and assurance over who can access their systems, data and critical services.
“That means applying strong controls such as multi-factor authentication, regularly reviewing third-party access, monitoring for unusual activity and having clear processes to verify sensitive requests. Just as importantly, businesses should have open conversations with suppliers about cyber resilience and understand how they would respond to a security incident.
“Cyber security is no longer confined to the boundaries of a single organisation. True resilience depends on the strength of the entire supply chain."
Sharp UK has a detailed guide onsite on why supply chain cyber security risk management matters and what you should do to strengthen it.
