An organization has received complaints from a number of its customers that their data has been breached. However, after an investigation, the organization cannot detect any indicators of compromise. The breach was MOST likely due to which type of attack?

The key detail is that the organization cannot find any indicators of compromise (IoCs) on its own systems, despite confirmed data breaches affecting its customers. This scenario is characteristic of a supply chain attack. In this type of attack, adversaries compromise a less-secure element in the supply chain, such as a third-party software vendor or a managed service provider. The organization then unknowingly introduces the malicious code or vulnerability into its own environment through a trusted channel (e.g., a software update). The attack originates externally, leaving few, if any, direct traces on the victim's network.

B. A zero-day attack exploits an unknown vulnerability but would still likely create detectable IoCs, such as anomalous system behavior, network traffic, or logs.
C. An injection attack, such as SQL injection, would leave clear evidence in web server access logs and database query logs, which are primary sources for IoCs.
D. A man-in-the-middle attack involves intercepting network traffic and would generate network-level IoCs, such as unusual certificate activity or traffic patterns.

1. National Institute of Standards and Technology (NIST). (2021). Defending Against Software Supply Chain Attacks (SP 800-218, SSDF V1.1 mapping). Introduction, p. 1.

2. European Union Agency for Cybersecurity (ENISA). (2021). Threat Landscape for Supply Chain Attacks. Section 2.1, "What is a supply chain attack?," p. 9.

3. Kim, Y., & Solomon, M. G. (2016). A Conceptual Framework for Auditing the IT Supply Chain. ISACA Journal, vol. 3, pp. 1-6.