Supply chain attacks: when things go wrong