Why Automotive Manufacturers Need to Treat Cyber Risk as a Supply Chain Issue

Modern automotive manufacturing relies on a broad and complex web of interconnected supply partners. While this interconnectivity helps manufacturers produce vehicles and parts at scale, more links in the supply chain mean a broader risk of cyberattack. 

Manufacturers’ reliance on third-party suppliers, such as those offering logistics and parts support, means that production may grind to a halt if an attack hits. Supply chain risks also mean that, even with a robust internal security posture, a manufacturer is only as secure as its partners.

According to the World Economic Forum’s Global Cybersecurity Outlook 2026, 65% of large businesses (by revenue) say supply chain and third-party weakness is their greatest challenge, up from 54% the year before.

In automotive manufacturing, where a single compromised supplier can stop a line in its tracks, cyber risk needs to be a key part of supply chain planning alongside quality and delivery risks.

When a Supplier Message Cannot Be Trusted

Fake emails and other confidence tricks remain a major access vector for data breaches, and payment-redirect scams top the data on phishing losses across industries.

Across automotive supply chains, suppliers routinely send emails about bank detail changes, logistics tracking, and specification changes. Phishers exploit these messages by crafting sophisticated emails and taking over genuine inboxes to make their requests look legitimate.

Phishers often aim to redirect payments to their own accounts or reroute deliveries. Alternatively, a hacked inbox can provide a route to launch ransomware attacks across a company and target its partners.

And, when a manufacturer receives an email from a trusted supplier’s genuine (but compromised) account, simple email checks, such as spam filtering, won’t flag it.

Manufacturers can close this gap by:

• Requiring at least two staff members to sign off on payment detail changes
• Confirming account changes by calling a number they have on file (never one they receive by email)
• Agreeing with suppliers, at the start of contracts, on channels to be used for payment and delivery changes
• Running regular phishing drills that send staff realistic emails from mock suppliers

When Supplier Updates Stop Reaching the Plant

Cyberattacks can immediately sever links between suppliers and manufacturing plants, causing supply chain disruption and halting just-in-time production and shutting plants down. Without updates to inventory levels and delivery schedules, manufacturers may have to pause production until communications can resume.

Tire maker Bridgestone, for example, faced a cyber incident in 2025 that impacted several of its North American plants, prompting round-the-clock efforts to limit supply chain fallout amid the risk of product shortages.

However, the dependency runs both ways. The Jaguar Land Rover (JLR) cyberattack, also in 2025, left suppliers with nothing to build for. 

Among them was Eberspächer, which produces exhaust systems for the manufacturer. It reported that its plant was on hold while JLR restored its systems, leaving staff on time off or on reduced hours.

To protect against full shutdowns, manufacturers should ensure manual fallbacks for ordering and scheduling (such as keeping phone contacts) are in place.

Manufacturers should also ask critical suppliers how long they expect to recover from a cyberattack and hold buffer inventories of single-source parts.

Who Can Access Shared Supplier Systems

Manufacturers and suppliers rely on several shared systems to run production and logistics. For example, suppliers may use portals to manage orders and submit quality documents. Both sides may also share cloud tools and storage, and equipment vendors may need remote access to maintain plant machinery.

The main cybersecurity concern here is a lack of clear accountability. With procurement managing supplier communications and IT handling logins and controls, it is not always easy for everyone to see the full picture.

Common security issues include remote access remaining active after an engagement ends. Others include shared logins that obscure who accesses what, and a lack of multi-factor authentication (MFA), which lets attackers break in with just a password.

In addition, a manufacturer may not know when certain supplier staff leave, so access rights may pass to someone new without prior authorization.

These gaps matter because a stolen supplier login is valid and recognized, meaning an attacker can easily imitate a legitimate user.

To protect against this, manufacturers should:

• Keep a detailed register, owned jointly by procurement and IT, of who has supplier access, why it was granted, and who approved it
• Restrict remote maintenance access to the duration of jobs
• Limit all suppliers only to systems and resources their jobs require
• Require suppliers to report when employees with access leave their firms, and remove access when contracts end
• Use MFA across individually named accounts on portals and remote access points

What to Agree With Suppliers Before an Incident

Supplier agreements won’t prevent every possible attack, but settling on a response in advance reduces damage and protects uptime. Before a cyberattack takes place, manufacturers and suppliers should agree on:

• How quickly either side must report suspected incidents
• Named contacts for either side, with after-hours numbers, stored offline
• Protocols for ensuring incident messages are genuine (such as calling numbers on file)
• Offline and fallback ordering and delivery arrangements, including which parts take priority
• What each side needs to see before systems are brought back online, including password reset confirmations

Manufacturers should also consider running joint tabletop exercises with critical suppliers, where both sides work their way through simulated, realistic incidents.

Crucially, manufacturers must give cyber resilience the same weight as quality and on-time delivery controls. An effective way to do this is to continuously review cyber readiness via the same supplier scorecards used to measure delivery and quality.

The result is a partnership that stays solid before and after cyber incidents, and production lines that recover faster after an attack.