Loading story…
Japanese semiconductor test-equipment manufacturer Advantest confirmed that attackers stole personal information during the ransomware attack it disclosed in February 2026. An October 6 notification identified exposed data including contact details, birth dates, identity documents and government identification numbers, medical information, and financial information. State filings list more than 500 affected California residents, 14 Massachusetts residents, and eight Vermont residents, but the total number affected and whether they are employees, customers, partners, or a combination remain undisclosed.
Advantest said it has no information suggesting that the stolen data has been publicly disclosed or misused, and no known ransomware group had publicly claimed responsibility as of October 7. The exposed information nevertheless increases the risk of identity theft and fraud. The company is offering affected individuals 18 months of free identity-theft, credit, and web monitoring through Kroll; recipients should enroll and monitor financial accounts and credit reports for suspicious activity.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
In a notification dated October 6, 2026, Advantest confirmed theft of personal information, including contact details, birth dates, government identifiers, and medical and financial information. The company said it had no information indicating leakage or misuse and offered affected individuals 18 months of free identity theft, credit, and web monitoring through Kroll.
A threat actor breached Advantest's network on February 15, 2026, gaining access to some systems. The February attack involved ransomware deployment and the extraction of data from company servers.
Advantest disclosed the network breach and ransomware deployment in February 2026. At that time, the company was still determining whether sensitive customer or employee information had been affected or exfiltrated.
Advantest's state notifications identified more than 500 affected California residents, 14 Massachusetts residents, and eight Vermont residents. The company did not disclose the total number of affected individuals.
After discovering the incident, Advantest took potentially affected and additional systems offline, enhanced security and monitoring, and reported containing the incident and safely restoring its network. The company also notified appropriate international authorities, including law enforcement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcesecurityweek.com
Open sourcebleepingcomputer.com
Open sourceoag.ca.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Advantest Corporation** reported a cybersecurity incident in which an unauthorized party appears to have accessed parts of its network and **deployed ransomware**, impacting certain internal systems. The company said it detected unusual activity on **Feb. 15 (JST)**, activated incident response procedures, **isolated affected systems**, and engaged third-party cybersecurity specialists to support investigation and containment; the investigation remains ongoing and findings may change as more facts are confirmed. Public reporting echoed Advantest’s statement that the scope and responsible ransomware group are **not yet identified**, and noted the broader trend of increased ransomware targeting of industrial and manufacturing organizations, including the semiconductor sector. Advantest stated it will provide updates and, if the investigation determines **customer or employee data** was affected, it will notify impacted individuals directly with guidance on protective measures.
Jun 29, 2026
**Advantest**, a major semiconductor chip-testing company, was reported as being **hit by ransomware**, indicating a disruptive cyber incident affecting a critical supplier in the semiconductor manufacturing ecosystem. Public reporting did not provide detailed technical indicators, the initial access vector, or the scope of impacted systems, but the incident aligns with ongoing ransomware targeting of large enterprises and operationally critical technology providers. Separate reporting during the same period emphasized that ransomware operators and initial access brokers frequently gain entry via **network edge devices**, particularly **firewalls** exploited through known vulnerabilities or compromised accounts, and that legacy exposures can remain in active use for years. This broader trend context is consistent with ransomware tradecraft but is not specific attribution or confirmation of the intrusion method used against Advantest.
Jul 12, 2026
Several significant data leaks and ransomware incidents have surfaced, affecting a range of organizations including Banco Vimenca, WIRED subscribers, Mexico’s Tax Administration Service (SAT), and New Zealand’s Neighbourly platform. Threat actors have claimed responsibility for exposing sensitive data such as government financial records, large-scale subscriber information, and user communications, with some incidents linked to ransomware groups. While the authenticity of these dark web postings remains unverified, the breadth of affected entities highlights ongoing risks to both financial institutions and government agencies from cybercriminal activity. In the United States, two banks—Artisans' Bank and VeraBank—have notified thousands of customers that their personal information was compromised in a ransomware attack on Marquis Software, a vendor providing data analytics and communication services to financial institutions. The attack, traced to a vulnerability in a SonicWall firewall, resulted in the exposure of names and Social Security numbers, though the banks’ own systems were not directly breached. These incidents underscore the persistent threat posed by supply chain vulnerabilities and the importance of robust third-party risk management for organizations handling sensitive data.
Jun 29, 2026