Supply Chain

• CrowdStrike disclosed on April 25, 2026, a sophisticated cyberattack via compromised third-party software affecting 2.5 million patient records at UnitedHealth's Change Healthcare subsidiary. • Attackers, linked to North Korean Lazarus Group, exfiltrated data over 72 hours before detection, demanding $22 million ransom. • Incident highlights vulnerabilities in US healthcare IT supply chains, prompting HHS emergency directives for 500+ providers.

• CrowdStrike disclosed on April 20, 2026, a sophisticated supply chain attack affecting 1,200 US clients, including Fortune 500 firms, via compromised third-party software. • Attackers deployed ransomware, encrypting critical systems and demanding $50 million in Bitcoin; no data exfiltration confirmed yet. • The incident highlights rising risks in software supply chains, echoing SolarWinds breach, with FBI joining investigation.

• The US administration reports that the Iran war is rattling the medical supply chain, affecting essentials from gloves to helium used in MRIs. • Shortages threaten hospitals nationwide as key imports from affected regions halt abruptly amid escalating conflict. • Medical leaders warn this could delay treatments and surgeries, exacerbating existing vulnerabilities in US healthcare logistics.

• AI recruiting platform Mercor confirmed a cybersecurity incident from a supply chain attack on open-source project LiteLLM, with hacker group Lapsus$ claiming data access and theft. • The breach exposed Mercor's systems, highlighting vulnerabilities in AI supply chains used by startups for model integration. • This incident underscores rising risks for AI firms relying on third-party libraries, potentially impacting hiring trust and data security standards.

• The U.S. government has designated Anthropic's Claude AI model as a potential supply-chain risk amid evaluations for military applications. • This follows Department of Defense introductions of new guardrail policies for military AI use, with xAI’s Grok also entering classified systems. • The move highlights growing scrutiny on AI models' security and reliability for national defense.

• U.S. District Judge Rita Lin ruled in favor of AI firm Anthropic, temporarily blocking the Pentagon from branding it a supply chain risk after failed defense contract talks. • The ruling also halts President Trump's directive for federal agencies to stop using Anthropic's Claude AI, following a hearing on March 24 in San Francisco federal court. • Judge Lin criticized the measures as punitive rather than protective, noting the government could simply cease using Claude without broader actions.

• Anthropic filed a lawsuit in San Francisco federal court on March 24, 2026, urging a judge to block the Pentagon's designation of the AI firm as a supply-chain risk. • The company described the label as 'unprecedented and stigmatizing,' amid a feud with the Trump administration over potential AI use in warfare. • A hearing occurred on Tuesday before Judge Lin, with Anthropic also filing a separate case in Washington, D.C. federal appeals court.

• The U.S. National Science Foundation on March 24, 2026, named winners of the multi-year Critical Minerals Challenge, including alkaLi Labs, ChemFinity Technologies, Intel-E-Waste, and University of Wisconsin-Madison, to secure domestic supply chains for lithium, cobalt, rare earths, and other metals. • Winners develop innovations like engineered biosorbents recovering lithium from byproducts, tunable polymer sorbents capturing over 25 metals at room temperature, modular e-waste processing platforms, and electrochemical electrodes generating acids in situ. • The program, co-designed with Germany’s SPRIND Tech Metal Challenge, uses donated e-waste from IBM and Aurubis with U.S. Naval Research Laboratory collaboration for national security relevance and real-world validation.