Advantest Corporation, one of the world's largest manufacturers of automated test equipment for the semiconductor industry, has confirmed that a ransomware attack earlier this year resulted in the theft of sensitive personal data belonging to customers, employees, or both.
What happened
The intrusion dates back to February 15, 2026, when a threat actor broke into Advantest's network and deployed a ransomware payload across parts of its systems. At the time, the company could not confirm whether any customer or employee data had been affected.
That uncertainty has now been resolved. In a data breach notification dated October 6, 2026, Advantest disclosed that an unauthorized third party extracted data from its servers during the incident, and that the stolen records included a broad set of personally identifiable information:
- Contact information
- Date of birth
- Social Security numbers
- National ID numbers
- Driver's license numbers
- Passport numbers
- Medical information
- Financial information
- Other ID numbers
Advantest has not disclosed how many individuals are affected, nor whether the exposed data belongs primarily to customers, employees, partners, or a mix of all three.
Why it matters
The combination of government ID numbers, financial details and medical information gives attackers nearly everything needed for identity theft, fraudulent account openings, or targeted phishing against the people named in the stolen records. Advantest says it currently has no evidence the data has been leaked or misused, and no ransomware group has publicly claimed the attack — but neither fact rules out quiet resale or later use of the data.
For an equipment supplier deeply embedded in global chip manufacturing, the breach is also a reminder that ransomware operators don't need to touch a factory floor to cause damage: back-office systems holding HR and customer records are just as valuable a target.
What to do
Advantest is offering affected individuals 18 months of free identity theft, credit and web monitoring through Kroll, with enrollment open until January 4, 2027. Anyone who receives a notification letter should:
- Enroll in the Kroll monitoring service before the deadline.
- Watch bank and credit statements closely for unfamiliar activity and report anything suspicious immediately.
- Treat unexpected emails or texts referencing this breach with suspicion — don't click links, open attachments, or share personal details in response.
- Consider a credit freeze if SSN or national ID exposure is confirmed in their case.
4tify will continue to track this incident for signs of the stolen data surfacing on criminal marketplaces.