One of the educational parts of this is that the phrase "supply chain attack" evokes image of Mission Impossible nonsense, whereas this was "just buy the reseller"...