Supply-Chain Attacks Can Hit Even Small Retailers