Advantest Took Months to Tell People Their Data Was Stolen in a Ransomware Attack

Japanese chip testing firm Advantest has finally started notifying individuals that their personal data was taken during a ransomware attack the company first disclosed back in February. If that timeline feels slow, that's because it is.

Advantest builds automatic test equipment used by major chipmakers including Intel and Samsung, so it sits in a fairly sensitive part of the semiconductor supply chain. When the February announcement came, the company acknowledged a network breach and ransomware deployment but said it hadn't yet confirmed whether any data had actually left the building.

Now we have the answer. The stolen data includes names, dates of birth, contact details, Social Security numbers, passport and driver's licence numbers, and medical and financial records. The full package, basically.

The company's statement to affected individuals strikes the usual careful tone: no evidence the data has been publicly posted or actively misused, but yes, you should probably worry about identity theft and fraud. Standard breach letter stuff.

Advantest hasn't published a total victim count. Reading between the lines of its regulatory filings, though, we can piece together a partial picture. Its submission to the California Attorney General lists over 500 affected residents. Massachusetts and Vermont filings show 14 and 8 impacted individuals respectively. Those are small numbers, which either means the breach was narrowly targeted or the full scale simply hasn't been made public yet.

Notably, no ransomware group has stepped forward to claim responsibility for the attack. That's not unusual, but it does make it harder to assess how serious the threat actors involved actually are.

For a company embedded in chipmaker infrastructure, a months-long gap between 'we were attacked' and 'here's what they took' is not a great look.