Supply Chain Risk

Algeria's trade ministry says a digital platform with what it calls "AI functionality" caught three different kinds of import fraud in one week. What's actually behind that label is unclear: the government hasn't named a vendor or said whether this is genuine machine-learning analysis or standard data-matching software wearing an AI label.

Bangladesh makes more of the world's clothing than any country except China, and a third of the banks financing that industry are buried in bad loans.

Two people, allegedly, and a thousand organizations paid for it.

A Nvidia DGX B300, a high-end AI server, sells for more than $1.1 million on China's black market, more than double its roughly $550,000 US retail price. Export controls have created a real market for stolen equipment, one worth enough that people are already going to serious lengths to acquire the hardware.

The corridor deal exists on paper. The money says it won't hold.

Two million devices got enrolled without anyone's permission. So far, nobody's been charged for it.

You can do everything right and still serve malware, because your website runs code you don't control.

You can still buy this material from anywhere. You just can't sell it anywhere but here.

A drought is quietly cutting how much cargo ships can carry through the Panama Canal.

If your 2027 planning assumes a Middle East ceasefire puts energy and freight costs back where they were, the last two weeks argue otherwise. Iran is turning the disruption into a revenue line, and the routes around it are being closed.

WD-40 sells aerosol lubricant off a hardware-store shelf. It reported a 100% spike in some of its sourcing costs this month, and traced it directly to Iran war disruption. That is the plainest evidence available that this war is already showing up in ordinary cost structures, not just shipping indices and oil futures.

An executive order signed July 20 and published in the Federal Register on July 23, "Securing America's Defense Supply Chains and Ensuring Domestic Acquisition of Critical Materials," directs the Department of War, the renamed Defense Department, to require prime contractors and subcontractors at any tier on national-security acquisitions to trace their supply chains back to raw-material origin, screen for prohibited sources, and submit mitigation or onshoring plans. Implementation guidance is due within 180 days.

For the past five months, almost everything the United States imports has carried an extra 10% tax at the border. That surcharge disappears on July 24. If you run a business that buys anything from overseas, the natural assumption is that your costs are about to drop. They are not. The 10% is being replaced by something more expensive that, unlike the surcharge, may never expire.

An investigation by OCCRP deserves a place on your security radar, because it lands on the single most sensitive tool most companies run: the password manager, the vault that holds the keys to everything else. This is not a story you will catch in your regular feeds.

On July 10, China banned all helium exports, effective the same day. The order, Announcement No. 29, came with no end date, no licensing exceptions, and no grace period for contracts already signed. Helium is not a nice-to-have for a lot of industries. It cools the magnets inside MRI scanners, it is used throughout semiconductor manufacturing, and it goes into fiber optics, aerospace, and anything that has to run at very low temperatures. There is no easy substitute for it.

A study out this month put a number on a supply-chain dependency few companies think to check. Chinese firms own, finance, or operate 78 of Africa's 231 commercial ports, and the control does not stop at the water's edge. It reaches into the software, the automation, and the artificial-intelligence systems that actually run them.

Everyone games out a Chinese invasion of Taiwan. The scenario Taiwan itself just practiced is quieter, more likely, and would reach your business faster.

For three years the United States has tried to keep advanced computing out of China's hands by cutting off the chips. This month China answered. A system called LineShine took the number one spot on the TOP500, the closely watched ranking of the world's fastest supercomputers, and it did it without a single American chip inside.

The magnets that turn electricity into motion, in your electric vehicles, your factory robots, your building's ventilation, your hard drives, almost all trace back to one country. A June paper from the Royal United Services Institute, a British defense think tank, set out the dependency using International Energy Agency data: China holds 91 percent of the world's capacity to refine and process the rare-earth elements those magnets are made from. There is no close second.

In the time it takes to read this paragraph, a software company somewhere shipped an AI feature built on components nobody reviewed. The competitive pressure to add artificial intelligence to every product, every platform, and every internal tool has created a supply chain problem that most companies have not recognized yet, because it sits one layer below the product they actually bought.

The United States-Mexico-Canada Agreement, the trade deal signed in 2018 to replace NAFTA, faces its first mandatory review on July 1. The review is supposed to be procedural: all three countries agree to extend it for sixteen years, or it enters annual reviews and begins winding down. It will not be procedural. All three members are pulling in different directions, and any company that built supply chain assumptions on this deal's stability should revisit them before next month.

The price of cyber insurance is falling, and the cheaper it gets, the easier it becomes to mistake a policy for protection. A cyber claim is denied far more often than most buyers expect, and a soft market widens the gap between having coverage and being protected.

In the past month, three African countries enacted restrictions on raw mineral exports, and a regional bloc launched an initiative to spread the model across sixteen more. Mozambique passed a new mining law requiring 15 percent free state equity in all mining ventures and banning the export of unprocessed minerals. Mozambique is the world's third-largest graphite producer, a critical input for EV battery anodes. Zimbabwe banned all raw mineral and lithium concentrate exports in February, then in April granted conditional export quotas to six mines that committed to building domestic processing plants by January 2027 and paying a 10 percent export tax. The Democratic Republic of Congo, which produces more than 70 percent of the world's cobalt, reclassified lithium as a strategic mineral and raised royalties from 3.5 to 10 percent of gross revenue. The Southern African Development Community (SADC, the regional bloc covering 16 nations) launched a five-year, EU-funded initiative to build critical minerals processing capacity across six member states.

For years, companies importing goods from China have used a simple workaround to avoid the tariffs designed to stop foreign manufacturers from undercutting American competitors by selling below cost. Ship the product to a third country like Vietnam, Malaysia, or Mexico. Relabel it. Import it into the US under the new country of origin. The duties that were designed to protect American manufacturers never get paid. The practice is so widespread that trade lawyers have a name for it: transshipment.

[Earlier this month](https://stateofthethreat.com/weekly/2026-05-10) we flagged the Financial Stability Board's estimate of $220 billion in bank exposure to private credit across its member jurisdictions. JPMorgan moved first.

Data center power demand is outrunning what utilities can build. AI is the dominant new driver, layered on top of existing cloud and streaming growth. The Department of Energy has started giving grid operators emergency authority to curtail data centers before residential neighborhoods.

[Last week](https://stateofthethreat.com/weekly/2026-05-17) we said the Hormuz pass-through had arrived. This week three signals confirmed it is staying.

For eleven weeks, the Strait of Hormuz crisis was an energy story. Oil prices rose. Shipping rerouted. You were told the disruption was about tanker traffic. This week it stopped being about tanker traffic.

The Trump-Xi summit in Beijing closed May 15 with a verbal framework both sides described as "constructive, strategic, and stable." No formal joint statement was issued. No chip export relief was announced. No rare earth supply framework was agreed. Jensen Huang attended as one of seventeen CEOs in the delegation and left without a semiconductor deal.

China controls roughly 60 percent of global rare earth mining, 90 percent of processing, and a significant share of the base chemicals other countries need to do their own processing. The materials go into motors, batteries, medical devices, defense systems, and the electronics on every desk in your office. Diversifying away from Chinese rare earths runs into a Chinese dependency one layer down. On Wednesday, President Trump meets President Xi in Beijing for a two-day summit where rare earth supply commitments and semiconductor export controls are both on the table.

Western Digital's CEO told investors on the company's Q2 earnings call that it is "pretty much sold out for calendar 2026." Seagate's CEO confirmed the same week that nearline capacity is "fully allocated through calendar year 2026," with contracts extending into 2028. Together, the two companies form a duopoly that controls virtually the entire global hard drive market. Enterprise drives in the 30 to 36 terabyte range are backordered two years. Prices are up 46 percent on average since September 2025, with some models nearly doubling. The Internet Archive, which preserves one of the largest collections of web history in the world, told 404 Media the shortage is "a very real issue costing us time and money."

The FBI issued a public service announcement on April 30 warning that cybercriminals are stealing physical cargo by impersonating legitimate trucking companies on digital load boards (online platforms where shippers post freight and carriers bid on it). Losses hit nearly $725 million in 2025, up 60 percent from the prior year. The average theft is now worth nearly $274,000.

The Association of Southeast Asian Nations (ASEAN), a bloc of eleven countries including Indonesia, the Philippines, Thailand, Vietnam, and Singapore, activated its first collective economic defense on April 27. In a special energy ministers' meeting, all members committed to no export bans on essential goods and moved to ratify the ASEAN Petroleum Security Agreement, a fuel-sharing framework originally signed in 1986 but never put into practice. For 40 years it sat on a shelf. The Hormuz closure pulled it down.

A consortium backed by the Africa Finance Corporation, the African Development Bank, and the Italian government committed $1.3 billion in April to build 830 kilometers of rail connecting Zambia's copper belt to Angola's Atlantic port of Lobito. The project cuts transit time from over a month by truck to seven days by rail. Total cost is $5 billion. Ground breaks before the end of the year, with financial close expected Q4 2027 and freight moving by 2030.

A $32 million compliance startup fabricated the security certifications your vendor assessment depends on. The cascade that followed exposed how thin the trust layer beneath the AI supply chain actually is.

Insurance closed the Strait of Hormuz before Iran's navy did. On February 28, 56 tankers transited normally. Within 72 hours, traffic fell to eight vessels. That happened before Lloyd's Joint War Committee (the body that designates conflict zones for the insurance market) redesignated the Arabian Gulf on March 3, before U.S. intelligence reported Iran planting naval mines by March 10, and before the first ship was seized on April 22.

Sulfuric acid is the reagent that processes copper ore, nickel, uranium, rare earths, and phosphate fertilizer. Nothing substitutes for it at industrial scale. The two major supply routes just closed simultaneously.

Last week we said there was no diplomatic process to end the Hormuz closure. This week there's a process that nobody in industry believes.

Fleet-management firm Geotab published its 2025 cargo-theft report in March. North American cargo theft hit $6.6 billion last year. Incidents rose 18 percent year over year. The average theft value climbed 36 percent to roughly $274,000 per event. Strategic theft (fraud, identity theft, falsified paperwork) is displacing traditional smash-and-grab crews. Geotab surveys show about a quarter of fleet professionals now cite strategic theft as their top threat.

The first face-to-face talks between the United States and Iran since the 2015 nuclear negotiations lasted 21 hours and collapsed. VP Vance left Pakistan without scheduling a follow-up. Iran's parliamentary speaker said Tehran has "no trust in the opposing side." Hours later, Trump floated the idea of a full naval blockade on Iran.

Over 90% of the world's most advanced semiconductors are made in Taiwan. The chips in your servers, your laptops, your phones. One island.

Your security perimeter protects your network. The problem is how much of your business runs on infrastructure that isn't your network. Three stories this week exposed three versions of the same blind spot.

Last week we reported that Chinese-flagged vessels were passing freely through the Strait of Hormuz while commercial traffic fell to near zero. That was the assumption. The data tells a different story, and the real one is worse.

On February 20, the Supreme Court ruled 6-3 that the International Emergency Economic Powers Act does not give the president authority to impose tariffs. The decision invalidated every IEEPA tariff collected since 2025. Estimated refunds owed to importers: $175 billion, with interest accruing at $650 million per month.

In September 2024, Hurricane Helene flooded a Baxter International plant in Marion, North Carolina. That single facility produced 60% of all IV solutions used in the United States. Hospitals rationed IV bags for five months until production resumed in February 2025. One hurricane. One building. Months of shortages across the country.

On March 18, the Office of the Director of National Intelligence released the 2026 Annual Threat Assessment before the Senate Select Committee on Intelligence. Director of National Intelligence Tulsi Gabbard presented the findings. The document is the intelligence community's annual public accounting of who threatens the United States and how.

Last week we reported that oil was near $99 a barrel and the Strait of Hormuz was under selective blockade. Both numbers got worse. On March 14, commercial traffic through the strait fell to zero. Brent crude, the international benchmark price for oil, is now trading between $106 and $119 per barrel, up more than 40% from $72 before the war began. Liquefied natural gas prices are up roughly 60%.

On March 13, Brazilian President Luiz Inácio Lula da Silva revoked the visa of Darren Beattie, a State Department official serving as senior advisor for Brazil policy, after Beattie attempted to visit former Brazilian President Jair Bolsonaro in prison. Bolsonaro is serving a 27-year sentence for his role in a coup plot. The move was reciprocal. The Trump administration had denied a visa to Brazil's health minister weeks earlier. US-Brazil relations are at their lowest point in decades.

Iran's Islamic Revolutionary Guard Corps, the regime's elite military branch, declared that "not a litre of oil" would pass through the Strait of Hormuz. The reality is more calculated than that.

While the shooting war dominates headlines, a separate conflict is increasing the cost of defending against it. US tariffs on Chinese imports have pushed the production cost of network security appliances up 14 to 18 percent. That increase hits the same whether your organization spends $5,000 or $50,000 on a firewall. This is not your vendor inflating quotes. The cost increase traces back to raw materials and components.

The EU wants to ban high-risk technology suppliers from 18 critical sectors. China has spent a decade embedding its equipment in networks worldwide. Brussels just fired the starting gun on a forced divorce.

Ninety-five percent of international internet traffic runs through cables on the ocean floor. State actors have been cutting them.