For threat actors looking to create widespread damage, attacking a third-party supplier with services and software that organizations can’t always control the security measures for continues to be an enticing target.