The MIT Center for Transportation and Logistics (CTL) has launched the Supply Chain Cybersecurity Lab, an interdisciplinary research initiative focused on addressing the rapidly escalating threat of cyberattacks on physical supply chain operations. As cybercrimes have caused significant impact worldwide, the lab is working with industry partners to develop research, tools, and strategies that help organizations protect their operations from cyber threats.
The lab was co-founded by Drs. Miguel Rodríguez García and Camilo Mora, researchers with backgrounds in industrial engineering and supply chain operations. Their collaboration emerged from the insight that supply chain and cybersecurity teams typically operate in silos, each responding to the same disruptions from isolated vantage points.
"A year and a half ago, I was at an industry conference when a supply chain professional told me their company had experienced a ransomware attack," Mora recounted. "The incident disrupted operations nationwide and took roughly three months to fully restore their systems. That moment made me realize the enormous impact that a cyber-attack can have beyond the classic IT department, affecting the flow of goods, information, and money all at once, plus reputational damage across the entire network."
The scale of the problem is unprecedented. The 2025 Jaguar Land Rover attack, for example, forced the UK-based manufacturer to shut down all plants for five to six weeks. The total impact to the UK economy from that single attack exceeded $2 billion, with Jaguar Land Rover alone spending more than $200 million on cyber recovery.
To investigate the issue, the lab is developing a number of research tools designed to address cyber threats across three time horizons. TRACE is an interactive platform that displays visualizations such as maps and other figures based on publicly available information about cyber incidents that have affected supply chains worldwide. Unlike data-breach repositories that focus on stolen information, TRACE uniquely captures operational consequences, such as which industries were hit, which systems were involved, how long disruptions lasted, and financial impact when available. Another tool, RADAR, identifies emerging cybersecurity risks before they become major supply chain threats by examining signals across domains like quantum computing, autonomous systems, and humanoids entering warehouses and manufacturing plants. SCOUT, the Supply Chain Operation and Vulnerability Threat Assessment tool, is a dynamic platform designed primarily for small and medium-sized suppliers that typically lack dedicated cybersecurity resources, allowing companies to map vulnerabilities and create improvement roadmaps. "We want to learn from the past so that we can better be prepared for the future," Mora explained, noting that large companies may have their own vulnerability management platforms, but "what about tier one, two, and three suppliers?"
The lab's research reveals that cyber threats to supply chains have evolved dramatically in sophistication and motivation. While ransomware attacks seeking payment remain the most common type, recent incidents show attackers increasingly focused on disruption rather than financial gain, a shift driven largely by state-sponsored cybercrime and geopolitical tensions.
"Attackers now target the weakest links in the supply chain, which are low-tier technology providers," García explained. "A single attack on one subsidiary software supplier can cascade across dozens of organizations. In one example, attackers shut down checking kiosks and automated baggage tag printers across four European airports—Brussels, Berlin, London Heathrow, and Dublin—by targeting a subsidiary supplier handling check-in processes."
The attack surface is expanding dramatically. While manufacturing once relied on isolated systems designed 10, 20, or even 30 years ago, those legacy systems are now connected to IT systems, cloud environments, and remote access tools, and every point of connection is a potential vulnerability. Meanwhile, the proliferation of AI tools, robotics, and connected equipment means supply chains have multiplied their technology suppliers from a handful to hundreds, with most lacking adequate cybersecurity capabilities.
When asked what realistic first steps companies should take, both co-founders offered the same answer: prioritize people. "Technology matters, but people remain one of the greatest sources of both vulnerability and resilience," Mora emphasized. "Companies can invest in sophisticated cybersecurity tools, but if employees are not aware of risks, if leadership doesn't know how to respond during a crisis, or if different functions don't know how to work together, the organization can still be extremely vulnerable."
The lab is addressing this through research, industry engagement, and education. The team has already conducted roundtables with industry leaders in Mexico and the MIT campus and conducted interviews with companies that have experienced major cyber incidents.
The Supply Chain Cybersecurity Lab's mission is encapsulated in a single principle: "Keeping supply chains moving even when technology fails." This requires coordinated action across the full system, with a focus on helping organizations prevent attacks, mitigate their impact, and recover faster.
"Our goal is to protect physical supply chains from cybercrime," García concluded. "We created this lab because supply chain and cybersecurity professionals have not been talking to each other. We're here to help companies continue operating even when technology fails, and we want to learn from companies that have suffered these attacks so we can bring those lessons back to the industry and make cybersecurity better for everybody."
For more information about the Supply Chain Cybersecurity Lab, click here.
