Advantest Confirms Ransomware Attack; Investigation Ongoing
Summary
Advantest says unusual IT activity detected on February 15 led to a ransomware investigation. The company isolated affected systems and engaged cybersecurity experts; data impact and significant operational disruption remain unconfirmed.
Key points
- Advantest detected unusual activity in its IT environment on February 15, 2026.
- The company said preliminary findings indicate an unauthorized party may have accessed parts of its network and deployed ransomware.
- Advantest isolated affected systems and engaged third-party cybersecurity experts; its investigation is ongoing.
- The company has not confirmed whether customer or employee data was affected, and no significant facility disruption has been reported.
- The article cites broader ransomware targeting of manufacturing, including Sophos observations of 99 threat groups targeting manufacturers in 2025.
Article Details
- Victim Organization
- Advantest
- Incident Type
- Ransomware attack; preliminary findings indicate an unauthorized third party may have accessed portions of the network and deployed ransomware.
- Incident Date
- 2026-02-15
- Disclosure Date
- 2026-02-19
- Operational Impact
- Advantest isolated affected systems and engaged third-party cybersecurity experts. No major operational disruption or confirmed customer or employee data compromise was reported; the investigation is ongoing.
- Ransom Or Extortion
- Ransomware was reportedly deployed, but no ransom demand or extortion details were reported.
- Claim Status
- confirmed
Threat Actors
AkiraSophos X-Ops identified Akira among prominent ransomware groups targeting manufacturing organizations based on leak-site observations; the article does not attribute the Advantest incident to Akira.PlaySophos X-Ops identified Play among prominent ransomware groups targeting manufacturing organizations based on leak-site observations; the article does not attribute the Advantest incident to Play.QilinSophos X-Ops identified Qilin among prominent ransomware groups targeting manufacturing organizations based on leak-site observations; the article does not attribute the Advantest incident to Qilin.
Industries
ManufacturingThe investigation is ongoing with no confirmed data or major operational impact, and the incident highlights increasing ransomware and state-backed targeting of the semiconductor and manufacturing sectors.SemiconductorsThe attack reflects broader targeting of manufacturing and semiconductors by groups like Akira, Qilin and Play and by state-backed actors using double-extortion tactics.