Advantest confirms personal data stolen in ransomware attack

The breach occurred on February 15, 2026, when a threat actor accessed Advantest's network and deployed ransomware. At the time, the company stated it could not determine whether customer or employee data had been compromised. In a notification to California's Office of the Attorney General, Advantest now says the attacker extracted personally identifiable information (PII).

Exposed data includes contact information, dates of birth, Social Security numbers, national ID numbers, driver's license numbers, passport numbers, medical information, financial information, and other ID numbers. It remains unclear whether the compromised data belongs to customers, employees, partners, or a combination.

Advantest reported it has no evidence that the stolen data has been leaked or misused, but it acknowledged an elevated risk of identity theft and fraud. To mitigate this, the company is offering affected individuals 18 months of free identity theft, credit, and web monitoring services from Kroll. Recipients have until January 4, 2027, to activate the offer.

BleepingComputer noted that no ransomware group has publicly claimed responsibility for the attack. Advantest did not respond to questions about the number of individuals impacted.

Analysis

Why This Matters

Affected individuals face heightened risk of identity theft and fraud given the breadth of exposed data, including Social Security numbers and financial information.
The eight-month delay between the breach and notification highlights ongoing challenges in detecting and confirming data exfiltration.
As a key player in semiconductor supply chains, Advantest's security incident raises concerns about the resilience of critical manufacturing infrastructure.

Background Advantest is a major Japanese supplier of automated test equipment used in semiconductor fabrication. The ransomware attack on its network in February 2026 initially appeared to be a standard encryption incident. The company's subsequent investigation revealed that data had been exfiltrated before encryption. The notification to California regulators suggests affected individuals include US residents, as the state requires disclosure of breaches involving personal information.

Key Perspectives Affected Individuals: Their personal and financial information is now in unknown hands, requiring vigilance and reliance on credit monitoring services for 18 months. Advantest: The company faces reputational damage and potential regulatory scrutiny. It has taken steps to contain the breach and provide remediation, but has not disclosed the scale of the incident or which ransomware group was involved. Cybersecurity Experts: The lack of public attribution and the time lag in detection underscore persistent vulnerabilities in industrial networks. Experts may urge greater investment in threat hunting and data exfiltration detection.

What to Watch

Whether a ransomware group eventually claims responsibility or leaks the stolen data, potentially revealing the number of affected individuals.
Any further disclosure from Advantest on the incident's scope, including the total number of impacted people and whether customers, employees, or both were affected.
Regulatory actions by California or other jurisdictions given the breadth of data types compromised.

Analysis

Sources