Identifying anomalous products in a supply chain includes maintaining a set of anomalous patterns of events products in the supply chain. At least one of the anomalous patterns of events is transmitted to nodes of the supply chain. Messages are received from nodes at a third party and indicate whether an event of the product in the supply chain at the node matches an event in the anomalous pattern of events that has been transmitted to the node. Messages indicating that an event at the node matches an event in the anomalous pattern of events are securely encrypted, based on a key that is unknown to the third party, prior to transmission to the third party. A determination is made whether the product is an anomalous product, based on the messages from nodes indicating that a sequence of events occurring at one or more nodes matches a sequence of events in the anomalous pattern of events.