When people think about cybersecurity, they usually think about their own company.
Their own server.
Their own email.
Their own firewall.
Their own backup.
But in the real world, business data does not stay inside one company anymore.
It moves between suppliers, vendors, contractors, cloud platforms, logistics teams, developers, consultants and customers.
That is why supply chain security has become so important.
On 3 July 2026, Reuters reported that India is investigating a data breach at Tata Electronics. The breach reportedly exposed documents linked to Apple’s unreleased iPhone 18 Pro, including sensitive component and supplier information.
At first, this sounds like a problem for very large companies.
But the lesson is useful for businesses of every size.
Your company may have strong internal controls. But if a vendor, supplier or partner has weak security, your data may still be exposed.
What Happened?
According to Reuters, India’s IT secretary said the government is investigating a data breach at Tata Electronics.
Tata Electronics is one of Apple’s suppliers in India. The reported leak involved files linked to Apple’s unreleased iPhone 18 Pro.
Reuters reported that sensitive component lists, supplier information and product photos were among files posted on the dark web by a ransomware group. The incident was also reported to India’s Computer Emergency Response Team.
Tata has reportedly hired a global consultant to conduct a forensic audit.
This matters because the leaked information was not just normal public data.
It reportedly included details related to suppliers, components and unreleased products.
That kind of information can be commercially sensitive.
Why Supply Chain Data Is Valuable
Supply chain data may not look dangerous at first.
It may be a list of suppliers.
A product drawing.
A component specification.
A delivery schedule.
A pricing document.
A project file.
But to competitors, attackers or ransomware groups, this information can be valuable.
It can reveal:
- Who your suppliers are
- What products you are building
- What components you use
- Which vendors you depend on
- Where your production risks are
- Which companies are connected to your business
- What confidential projects are in progress
For a large company, this can affect product secrecy.
For an SME, it can affect pricing, customer trust, tender information, project confidentiality and business reputation.
That is why data protection should not only focus on customer information.
It should also cover business documents, supplier records, internal project files and operational data.
The Risk Is Bigger Than One Company
Modern businesses are connected.
A company may use one vendor for website hosting, another for email, another for accounting software, another for backup, another for cybersecurity and another for software development.
Every connection adds convenience.
But every connection also adds risk.
If one partner has access to sensitive files, that partner becomes part of your security environment.
This is where many businesses make a mistake.
They secure their own office laptop and email, but they do not check how vendors handle company data.
They share files through personal email.
They send passwords through messaging apps.
They give vendors permanent access.
They do not remove old accounts after a project ends.
They do not ask where the files are stored.
They do not confirm whether backups are protected.
Small gaps like this can lead to big problems.
Why Ransomware Groups Target Suppliers
Attackers often target suppliers because suppliers may be easier to breach than the main company.
A large enterprise may have strong security.
But a smaller vendor may not have the same budget, tools or monitoring.
If the vendor holds sensitive data from many customers, it becomes an attractive target.
This is why supply chain attacks are dangerous.
The attacker does not always need to break into the main company directly.
They can attack a weaker connected party.
This can include:
- IT vendors
- Software providers
- Manufacturing suppliers
- Outsourced support teams
- Cloud service providers
- Marketing agencies
- Accounting firms
- Logistics partners
- Contractors and freelancers
For SMEs, this is a serious point.
Even if your business is not a large enterprise, you may still handle important data for your customers.
If your system is breached, it may affect your customers too.
What Businesses Should Learn From This
The Tata incident is a reminder that cybersecurity is not only a technical issue.
It is a business trust issue.
When a customer shares data with you, they expect you to protect it.
When you share data with a vendor, you should also expect them to protect it.
But trust alone is not enough.
There must be controls.
Businesses should ask simple but important questions:
- Who has access to our sensitive files?
- Are old vendor accounts still active?
- Do vendors use secure file sharing?
- Are passwords shared safely?
- Are files stored in approved cloud platforms?
- Is backup enabled?
- Is endpoint protection installed?
- Is there a data recovery plan?
- Can we trace who downloaded or edited files?
These questions are not only for large corporations.
They are practical questions for any business that works with customers, suppliers or partners.
Data Loss Prevention Is Becoming More Important
One important control is Data Loss Prevention, often called DLP.
DLP helps reduce the chance of sensitive information being shared, uploaded, emailed or copied to the wrong place.
It can help detect and prevent risky actions such as:
- Sending confidential files to personal email
- Uploading sensitive documents to unapproved platforms
- Sharing customer data outside the company
- Copying restricted files to external devices
- Exposing financial or project information accidentally
DLP is not perfect.
But it gives businesses better visibility and control.
Without DLP, many companies only find out about data leakage after the damage is done.
Access Control Must Be Reviewed Regularly
Many data leaks happen because access was not properly managed.
Someone needed access for a project.
The project ended.
But the access stayed active.
This is common.
It happens with vendors, former staff, contractors and temporary users.
Businesses should review access regularly.
A simple access review can help answer:
- Who can access important files?
- Do they still need access?
- Is access limited to the right folders?
- Are admin accounts protected?
- Is multi-factor authentication enabled?
- Are shared passwords being used?
Good access control does not need to be complicated.
The basic rule is simple:
Give people only the access they need, for only as long as they need it.
Backup Still Matters
When ransomware is involved, backup becomes critical.
If files are encrypted, deleted or stolen, the company needs a clean recovery point.
But not all backups are equal.
A proper backup plan should include:
- Automatic backup
- Offsite backup
- Immutable backup where possible
- Regular recovery testing
- Clear recovery time objective
- Clear recovery point objective
In simple terms, businesses need to know two things.
How much data can we afford to lose?
How fast do we need to recover?
If the answer is unclear, the backup plan is not ready.
What SMEs Should Do Now
SMEs do not need to build a large enterprise security team.
But they should take practical steps.
1. Identify Sensitive Business Data
Start by knowing what needs protection.
This may include customer records, quotations, contracts, project files, supplier details, source code, financial documents and login credentials.
2. Review Vendor Access
Check which vendors currently have access to your systems, files, cloud platforms or customer information.
Remove access that is no longer needed.
3. Use Secure File Sharing
Avoid sending confidential files through personal email or random file transfer tools.
Use approved platforms with access control, expiry links and audit logs.
4. Enable Multi-Factor Authentication
MFA should be enabled for email, cloud storage, admin panels, remote access and business-critical systems.
This is one of the simplest ways to reduce account takeover risk.
5. Protect Endpoints
Laptops and workstations should have endpoint protection.
Many breaches start from a compromised device.
6. Strengthen Backup and Recovery
Backup should not be treated as optional.
It is the last line of defence when prevention fails.
7. Create a Simple Data Handling Policy
Staff should know what data is confidential, where it can be stored and how it can be shared.
The policy does not need to be long.
It just needs to be clear.
The Bigger Picture
The Tata data leak shows how connected today’s business world has become.
A data breach at one company can affect another company’s product, supplier network and business confidentiality.
This is the reality of modern supply chains.
For businesses in Malaysia and around the world, the message is clear.
Cybersecurity must include your partners, vendors and suppliers.
It is no longer enough to secure only your own server.
You also need to control how data moves across your business ecosystem.
Closing Thoughts
Data is one of the most valuable assets in any business.
It may be customer data, project data, supplier data, product data or financial data.
Once it is exposed, the damage can be difficult to reverse.
The reported Tata Electronics breach is a strong reminder that every business should review how sensitive information is stored, shared and protected.
For SMEs, the best starting point is simple.
Know your sensitive data.
Control who can access it.
Secure how it is shared.
Protect endpoints.
Back up properly.
Review vendor access regularly.
At Net Onboard, we help businesses build secure and reliable cloud environments through managed cloud hosting, cybersecurity, backup and business continuity solutions.
If your business wants to improve data protection, strengthen cloud security or reduce the risk of data loss, speak to our team today.