When hackers sat undetected inside IKAD Engineering for five months and walked out with data relating to Australia’s Hunter and Collins class submarine programs, they did not need to break into the Department of Defence. They only needed to compromise one small engineering subcontractor. The defence supply chain cyber attack trend has escalated sharply through 2025 and 2026, and the targets are almost never the prime contractors. They are the SMEs nobody has heard of. If your business sits anywhere in the Australian defence, aerospace, or critical infrastructure supply chain, this is the threat landscape you need to understand today.
What the IKAD Defence Supply Chain Cyber Attack Revealed
IKAD Engineering is an Australian supplier providing components and services to defence, marine, mining, and oil and gas. In November 2025, the J Group ransomware gang claimed to have exfiltrated up to 800 gigabytes of data through a vulnerable legacy VPN, maintaining a hidden presence inside the network for approximately five months.
The stolen data allegedly included:
- Naval contract documents
- Engineering specifications for the Redback Infantry Fighting Vehicle program
- Hunter class frigate and Collins class submarine project materials
- HR records and internal communications
The attackers used a technique called “living off the land,” relying on legitimate administrative tools already present on the network to avoid detection.
Why the Defence Supply Chain Cyber Attack Vector Is So Effective
Prime contractors like BAE Systems, Lockheed Martin, and Thales invest tens of millions in cyber defence every year. Smaller subcontractors usually do not. The attackers know this.
The defence supply chain cyber attack pattern in 2025 and 2026 shows a consistent approach:
- Identify SME suppliers via open-source intelligence and tender records
- Find legacy VPNs or unpatched perimeter devices
- Gain entry and remain undetected for months
- Harvest sensitive project data that maps to national security interests
- Extort the SME and publish data if unpaid
The Defence Industry Security Program (DISP) Is No Longer Optional
Any business wanting to win or retain defence contracts in Australia increasingly needs to demonstrate membership in the Defence Industry Security Program. DISP requires:
- Documented information security governance
- Physical and personnel security controls
- Alignment to the ACSC Essential Eight
- Formal incident reporting processes
Meeting DISP is not just a compliance exercise. It is the baseline for surviving a defence supply chain cyber attack.
Recommended Link: Penetration Testing for Defence and Critical Supply Chains
Five Controls That Would Have Stopped the IKAD Attack
- Retire legacy VPNs. Move to modern Zero Trust Network Access (ZTNA) solutions
- Deploy endpoint detection and response (EDR). Traditional antivirus cannot catch living-off-the-land attacks
- Enforce privileged access management. Limit and log administrative actions
- Continuous log monitoring (SIEM). A five-month dwell time is a monitoring failure, not a prevention failure
- Regular penetration testing. Assume a breach and test how far an attacker could move
Recommended Link: SIEM and 24/7 Security Monitoring
Is Your Business the Weak Link in a National Security Supply Chain?
The defence supply chain cyber attack trend will intensify through 2026. Prime contractors are now demanding proof.
- Review your current DISP alignment
- Upgrade legacy VPN and remote access immediately
Frequently Asked Questions
Q: I am a small engineering or services firm. Am I really a target?
A: Yes. Attackers increasingly target Tier 2, Tier 3, and Tier 4 suppliers precisely because their security posture is weaker than the prime contractors they serve.
Q: What is the difference between DISP and the Essential Eight?
A: DISP is the Defence-specific security framework. The Essential Eight is the broader ACSC baseline that feeds into DISP requirements. Most DISP-aligned businesses implement Essential Eight as the foundation.
Q: How long does it take to prepare for DISP membership?
A: For most Australian SMEs with a low starting maturity, a realistic DISP readiness program takes three to nine months depending on scope and existing controls.
The defence supply chain cyber attack against IKAD Engineering is a preview of what is coming for every Australian SME that handles sensitive commercial or government project data. Attackers are patient, they are coordinated, and they already know where the weak links are. The question is whether yours will hold.
(We are not looking to replace your current provider, just offering an alternative perspective)
Written by Neil Frick
Sources & References
- Cyber Daily – Threat actor alleges treasure trove of sensitive Hunter, Collins class info – https://www.cyberdaily.au/security/12887-exclusive-threat-actor-alleges-treasure-trove-of-sensitive-hunter-collins-class-info
- ABC News – Defence cyber attacks ADF military projects Redback hackers – https://www.abc.net.au/news/2025-11-19/defence-cyber-attacks-adf-military-projects-redback-hackers/105999222
- Defence Industry Security Program overview – https://www.defence.gov.au/security/industry