NIS2 Part One: Why Your NIS2 Supply Chain Strategy Is Already Falling Short

Tens of thousands of European organizations are legally accountable for the security of companies they do not control but on whose services they rely. Under Article 21(2)(d) of the NIS2 Directive, any in-scope entity is required to manage supply chain security, including the security aspects of its relationships with its direct suppliers and service providers. Article 21(3) further specifies that an organization must take each supplier’s specific vulnerabilities into account.

However, neither article imposes anything at all directly on the supplier. Most organizations are currently trying to discharge their duty of care using a supplier questionnaire. Ultimately, a questionnaire only captures the existence of controls at a given point in time; it cannot measure security that needs to be assessed as circumstances change and evolve, nor can it guarantee the full scope or efficacy of those controls.

Recent real-world cases across Germany, France, and Italy highlight the severe operational gaps created by these regulatory and supply chain dynamics.

Germany: unimed & University Hospitals

On 14 April 2026, unimed, a medical billing service provider for the German healthcare sector that has been invoicing for German hospitals since 1984, identified a ransomware attack. While the attackers failed to encrypt the provider’s systems, they exfiltrated data before being shut out.

The fallout spread rapidly across downstream healthcare providers:

• Freiburg University Hospital disclosed on 21 May that master data for roughly 54,000 patients and billing data for 900 patients had been taken, from which diagnosis and treatment information could be inferred.
• Heidelberg reported around 11,000 patients and 2,700 records impacted.
• Ulm reported around 1,600 patients and 300 records.
• Bonn counted 1,304 people affected (218 with health data) and notified the local data protection authority within 36 hours.
• By 1 June, the state data protection authority in Baden-Württemberg alone had received breach notifications from 17 hospitals.

Not a single hospital network was touched directly. A clinic in Karlsruhe noted that its own network was prepared to stop lateral movement, but the hospitals' own networks were never the perimeter.

France: Harvest SA & Downstream Software Risks

France's national transposition of NIS2 has faced delays, with the Senate passing a transposition bill on 12 March 2025 and the country being referred to the European Court of Justice alongside Ireland, Spain, and the Netherlands. Despite the legal delays, attacks continue.

In February 2025, Paris fintech Harvest SA discovered a ransomware attack that crippled its wealth-management software, used by more than 4,600 clients, taking services offline for about four weeks. The root cause was a virtual machine hosted at one of Harvest SA's own service providers. A banking supervisor later confirmed to Parliament that the banks' software supplier was compromised through the software supplier's supplier. Downstream impacts included MAIF notifying 55,000 clients and prospects, BPCE notifying customers across subsidiaries, and AXA France notifying twenty clients.

Harvest SA possessed mature security controls, including multi-factor authentication (MFA) for at least some accounts, EDR, XDR, SIEM, and patch management. Yet, a standard vendor questionnaire only verifies that controls exist, not their full scope or efficacy.

Italy: Strict Timelines & Regulatory Enforcement

Italy has passed its local implementation of NIS2 under D.Lgs. 138/2024. The first cohort of NIS entities received notifications of inclusion on 12 and 13 April 2025 and must have basic security measures in place 18 months later, putting their deadline at the end of October 2026 with no extension.

Supply chain incidents in the region illustrate the pressing scope of the issue:

• On 20 November 2025, ICT group Almaviva S.p.A. (65 companies, 40,000 people) detected an intrusion resulting in unauthorized data extraction. While Almaviva disclosed no volume or entry vector, attackers claimed 2.3 terabytes of staff records and industrial plans.
• On 26 June 2026, Trenitalia disclosed unauthorized access to its ticketing databases dating back to October 2025, warning passengers to expect fraudulent messages and phishing attempts.

Scoping Gaps and Contractual Realities

Small suppliers are not directly obliged by NIS2 or national implementing laws to comply. As the German BSI notes, firms outside the law’s scope that serve in-scope entities should expect requirements to be pushed down strictly through customer contracts.

According to ENISA’s German BSI notes report (December 2025), 37% of respondents name supply chain risk management as the most difficult NIS2 requirement. ENISA’s May 2026 survey further shows that SMEs in highly critical sectors find compliance significantly more challenging than larger organizations.

Italy stands out as an exception in how it handles this gap: under ACN’s Determinazione 127437/2026 , in-scope organizations must submit an annual list of suppliers. The ACN then determines which suppliers are essential or important under Article 3 of D.Lgs. 138/2024 based on the volume of in-scope entities they serve, allowing the supervisory authority to impose direct security requirements rather than relying purely on private contracts.

Across Europe, however, scoping remains unresolved, particularly for ICT service management, which ENISA’s NIS360 2026 report flagged as a primary risk zone where criticality has outrun maturity.

The Compliance Landscape Today

Compliance duties are already live in Germany, where roughly 17,700 entities are registered out of an estimated 29,500 in scope. In Italy, boards face the end-of-October deadline. In France, the absence of finalized national law offers no practical reprieve from active threats.

Cyber incidents consistently exploit supply chain vulnerabilities. Contractual agreements and vendor questionnaires are no longer sufficient on their own to address risks that span multi-tiered supplier networks.

Establishing contractual controls and issuing vendor questionnaires may help meet baseline administrative duties under NIS2, but it does not prevent exfiltrated vendor data from being weaponized against your organisation. In part two of this NIS2 series, we examine how cybercriminals turn stolen supplier databases into hyper-personalized phishing infrastructure, how national laws trimmed employee training mandates, and how to defend the human perimeter.