A supply chain attack targeting online advertising firm Adform recently exposed a sobering truth for small and medium businesses: the code you never wrote can still get you breached. Attackers compromised a JavaScript file served through Adform's ad delivery infrastructure, quietly injecting malicious code that intercepted cryptocurrency wallet activity on any website loading that script. Visitors to affected sites had funds stolen without any warning, and the website owners themselves had no idea their pages were being weaponised.
What Actually Happened in This Supply Chain Attack
The attack followed a pattern that security researchers call a supply chain compromise. Instead of breaking into your business directly, attackers targeted a trusted third-party vendor whose code runs on thousands of websites simultaneously. By altering Adform's JavaScript, they effectively hitched a ride on a piece of infrastructure that publishers and advertisers treat as routine. The malicious script watched for cryptocurrency wallet interactions in the browser, then redirected transactions to attacker-controlled addresses. From a visitor's perspective, everything looked normal until their funds disappeared.
This is not an isolated incident. Similar attacks have hit analytics providers, customer chat widgets, cookie consent tools, and payment processors. Every third-party script your website loads is a potential entry point that bypasses your own security entirely.
Why SMBs Are Particularly Exposed
Large enterprises often have dedicated security teams auditing every external dependency on a rolling basis. Most small and medium businesses do not have that resource. You integrate an ad network, a booking widget, a live chat tool, and a newsletter sign-up form, and then you move on. Those integrations sit on your site for months or years, quietly updating themselves in the background, and nobody is watching.
The reputational damage from an incident like this falls on the business whose website visitors were harmed, even if the root cause was a vendor's compromised server. Your customers do not distinguish between your code and someone else's. If they lose money or data while on your site, you own that problem in their eyes. Regulatory exposure under data protection frameworks can follow, particularly if customer credentials or payment data were also in scope.
There is also a secondary risk that often goes unnoticed. When attackers compromise a vendor's infrastructure, they frequently harvest credentials and session tokens from the environments they touch. Those stolen credentials end up in infostealer logs and dark web markets within days. If any of your staff or customers had accounts connected to affected services, their login details may already be circulating.
How to Reduce Your Third-Party Script Risk
You do not need a large security budget to take meaningful action. Start by auditing every external script currently loading on your website. Your web developer or IT manager can pull this list from your site's source code or a tool like a browser developer console. Question whether each one is still necessary and whether the vendor has a published security policy.
For scripts that must stay, ask your developer about implementing a Content Security Policy, which is a browser-level control that restricts which external sources are allowed to run code on your pages. It is not foolproof, but it significantly raises the bar for attackers. Subresource Integrity checks are another technical measure worth knowing about: they allow browsers to verify that a loaded script has not been tampered with since you approved it.
Beyond your website, monitor whether your business domain, employee email addresses, or customer-facing credentials are appearing in breach databases or infostealer dumps. Supply chain incidents like the Adform compromise often generate leaked credential sets that surface on dark web forums and paste sites long before victims are notified officially.
Staying Ahead of Threats You Did Not Create
The Adform supply chain attack is a reminder that your security posture is partly defined by the vendors you trust. You cannot fully control what they do, but you can monitor the consequences when things go wrong, reduce unnecessary third-party dependencies, and build habits that catch credential exposure early.
For SMBs without a full-time security team, that means leaning on tools that do the watching for you. Breachrr continuously checks breach databases, infostealer logs, dark web markets, public code repositories, and domain infrastructure for signs that your business data has been exposed, whether the source was your systems or a vendor's. If your credentials or customer data are out there, you deserve to know before the damage compounds.
Run a free audit at breachrr.com/audit and find out what is already exposed.
Want to see if your company is exposed?