Advantest confirms February ransomware attackers stole SSNs, passport and medical data
Advantest confirmed on October 6 that February's ransomware intruders stole Social Security and passport numbers along with medical and financial data. Its chip-industry customers and suppliers cannot yet tell whether their own staff are affected.
The Watch · Security desk
What happened
- Attackers deployed ransomware on Advantest's network in February, and at the time the company said it could not tell whether customer or employee data was affected.
- The stolen fields also include contact details, dates of birth, national ID and driver's license numbers, and other ID numbers.
- BleepingComputer asked Advantest how many people were affected and had received no reply by publication.
- Advantest is offering 18 months of free Kroll identity theft, credit and web monitoring to recipients who activate by January 4, 2027.
Why it matters
- Who's exposed exposure Contact details were taken along with ID numbers, so phishers who already hold a recipient's data can reach that person; the guidance says never to send money or information in reply to email or text requests.
- Who has to decide decision Recipients get 90 days from the notice date to enroll, so anyone who leaves the letter unread for three months loses the free Kroll coverage.
- What it limits constraint Advantest's statement that it has no information of leaks or misuse is the only public account of where the data went, and recipients cannot check it for themselves.
Next story · Security · 8h ago
Semperis survey puts threats against ransomware victims' staff at 40% of attacksConfirmed2 publishers
I'd rate the fraud risk as real for anyone who gets a letter. Advantest itself acknowledges that the people exposed face an elevated risk of identity theft and fraud [11]. Recipients are also told to watch their account and financial statements and to report unfamiliar transactions to their bank [15].
The notice settles what kind of incident this was. "In February 2026, Advantest became aware of a cybersecurity incident in which an unauthorized third party accessed Advantest systems and extracted some data from our servers," it reads [5]. The next line is addressed to the recipient: "The data extracted from our servers included PII (personally identifiable information) belonging to you" [12]. That confirmation came 233 days after the February 15 intrusion [17].
Advantest makes automated test equipment for the semiconductor industry [1]. Semiconductor companies that buy from or supply Advantest should now review the incident as a data-theft breach, because exfiltration is confirmed [4]. The letters go to the individuals whose PII was taken [12]. A supplier will learn that its own staff are involved only if those people report receiving one.
The notice calls the intruder only "an unauthorized third party" [5]. BleepingComputer found no ransomware group publicly claiming the attack as of its report [13]. On that record this is one intrusion at one company, with no link yet shown to a wider campaign.
What to watch
- A ransomware group posting Advantest data on a leak site would name the operator and test the company's statement that it has no information of misuse.
- An answer to BleepingComputer's question on the number of affected individuals would size the breach for the first time.
- A statement from Advantest that customer or partner employees are among those affected would make this a vendor-risk notification for the semiconductor companies it serves.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Advantest Corporation is a Japanese global manufacturer of automated test equipment for the semiconductor industry.
- [2]
On February 15, 2026, a threat actor breached Advantest's network and gained access to some of its systems.
- [3]
At the time, Advantest's disclosure said hackers had accessed parts of its network and deployed a ransomware payload, but the company could not determine whether customer or employee data had been impacted.
- [4]
In a data breach notification dated October 6, 2026, Advantest confirms that data was stolen in the attack.
- [5]
"In February 2026, Advantest became aware of a cybersecurity incident in which an unauthorized third party accessed Advantest systems and extracted some data from our servers,"
- [6]
Exposed data types include Social Security Numbers, passport numbers, medical information and financial information.
- [7]
Exposed data types also include contact information, date of birth, national ID numbers, driver's license data and other ID numbers.
- [8]
It is unclear whether the compromised data belongs to customers, employees, partners, or a combination of these groups.
- [9]
BleepingComputer asked Advantest about the number of affected individuals and had not received a response as of publication.
- [10]
Advantest says it has no information that the compromised data has been leaked or otherwise misused.
- [11]
Advantest recognizes the elevated risk of identity theft and fraud for exposed individuals.
- [12]
"The data extracted from our servers included PII (personally identifiable information) belonging to you."
- [13]
At the time of writing, BleepingComputer could not find any public claims from ransomware groups targeting Advantest.
- [14]
Advantest offers free 18-month identity theft, credit and web monitoring services from Kroll, and letter recipients have until January 4, 2027 to activate the offer.
- [15]
Impacted individuals are recommended to closely monitor their accounts and financial statements for suspicious activity and report unknown transactions to their bank.
- [16]
Recipients are advised to be cautious about phishing, avoid clicking links or opening attachments, and never send money or share sensitive information in response to requests made via email or text.
- [17]
233 days passed between the February 15, 2026 intrusion and the October 6, 2026 notification confirming data theft.
- [18]
Recipients have 90 days from the October 6, 2026 notice date to activate the Kroll monitoring by the January 4, 2027 deadline.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comAdvantest confirms personal information stolen in ransomware attack
2 articles · October 7, 2026
- securityweek.comAdvantest Discloses Data Breach Months After Ransomware Attack
1 article · October 7, 2026
Topics and entities
Topics
- Ransomware
- Data Breach Notification
- Semiconductor supply chain security
Entities
- Advantest Corporation