Advantest Confirms Stolen Data in Attack

Advantest, the Japanese manufacturer of automatic test equipment for semiconductors, is now telling people that its February 2026 ransomware incident involved stolen personal data. The company disclosed the network breach months earlier but said at the time it was still trying to establish whether anything sensitive had left its systems. The breach notifications going out now answer that question.

According to SecurityWeek, the attackers took personally identifiable information from Advantest's systems. The company has not said how many people are affected in total, and no ransomware group has publicly claimed responsibility for the intrusion.

What the Notifications Actually Say

The data breach notifications describe the categories of information the attackers obtained. Advantest told recipients that the stolen personally identifiable information includes names, dates of birth, contact information, Social Security numbers, passport and driver's license numbers, and medical and financial information.

The company's message to affected individuals acknowledged the risk that comes with that combination of data. Advantest's notification stated directly: "We have no information suggesting that your PII has been disclosed publicly or otherwise misused. However, this incident may have placed you at increased risk of identity theft or fraud."

That language tracks what breach notifications typically say when a company cannot confirm whether stolen data has surfaced. Advantest has not said whether the exfiltration happened before or after the ransomware payload was deployed, nor has it identified the ransomware variant involved or the initial access vector.

State Filings Reveal a Partial Count

Advantest has not published a total number of affected individuals. What is available comes from state attorney general filings, which give a partial picture of the scope.

The company's filing with the California Attorney General's Office indicates that more than 500 California residents are affected. Notifications submitted to attorneys general in Massachusetts and Vermont list 14 and 8 affected residents, respectively.

Those figures reflect only the residents in states that require notification and publish the filings. Because the company has not disclosed a nationwide or global total, the full number of people affected by the breach remains unknown.

How the Attack Unfolded

Advantest said in February 2026 that hackers had breached its network and deployed ransomware. At that point, the company was still working to determine whether any sensitive information had been exfiltrated.

The gap between the February disclosure and the current notifications reflects how long it can take to complete a forensic review of a ransomware intrusion and determine what data was taken. Advantest did not say when it concluded that personal information had been stolen, only that it is now notifying individuals.

What remains undisclosed is substantial. The company has not named the attackers, has not said whether a ransom was paid, and has not described how the intruders initially gained access to its network.

No Public Claim of Responsibility

No known ransomware group appears to have taken credit for the attack on Advantest. That absence is notable because ransomware operators typically post victims to leak sites when they want to pressure a company into paying.

Advantest has not confirmed whether it received a ransom demand, whether it negotiated with the attackers, or whether any payment changed hands. The company has also not said whether the stolen data was posted anywhere or offered for sale.

Because no group has claimed the attack and Advantest has not named one, the identity of the actors behind the intrusion remains unknown publicly.

The Data Categories and Why They Matter

The information Advantest says was taken spans several categories that carry different kinds of risk. Names and dates of birth are foundational identifiers used to open accounts or pass identity checks. Social Security numbers and driver's license numbers are the keys that make those identifiers usable for fraud. Passport numbers add another government-issued credential to the mix.

Medical and financial information adds a further dimension. Medical records can contain diagnoses, treatment histories, and billing details. Financial information can include account numbers or other data tied to a person's money.

When those categories are combined, the exposure is broader than a single identifier. A person whose name, date of birth, Social Security number, and financial information are all in the same stolen dataset faces more avenues for misuse than someone whose email address alone was exposed.

What the Company Told Recipients

Advantest's notification did not describe specific remediation services the company is offering, such as credit monitoring or identity theft insurance, according to the source article. The company's message focused on what it knows about the data and the risk to the individual.

The statement that Advantest has no information suggesting the PII has been publicly disclosed or misused is a qualified assurance. It describes the absence of evidence, not evidence of absence. Stolen data can surface months or years after a breach, and companies often cannot track what happens to it once it leaves their systems.

Recipients who want to act on the notification would typically need to determine for themselves what protections to put in place. The notification itself does not say what those steps should be.

The Broader Context of the Disclosure

The Advantest case joins a series of recent breach disclosures that SecurityWeek has covered, including ASOS confirming a cyberattack and data breach and incidents affecting government and healthcare systems.

Those other incidents involved far larger affected populations. A cyberattack on Arizona's court system resulted in personal information for over 1 million people being stolen, and a breach at Denmark's central person register impacted 8.8 million people. Separate healthcare breaches in New Jersey and Texas affected 250,000 people.

Advantest's publicly known count, by contrast, is limited to what the state filings show: more than 500 in California, 14 in Massachusetts, and 8 in Vermont. Those numbers are a floor, not a total.

Why the Timeline Matters for Those Notified

The February disclosure came with a caveat: Advantest said it was still working to determine whether sensitive data had been exfiltrated. The notifications now confirm that it had.

That sequence means affected individuals are learning about the theft of their data months after the intrusion itself was disclosed. For anyone who received a notification, the relevant facts are what the company says was taken and what it says it does not know.

Advantest has not said how long the attackers had access to its network, when the data was taken, or why the determination took the time it did. The company also has not explained what security changes, if any, it has made since the incident.

What Remains Unanswered

The disclosure leaves several core questions open. Advantest has not disclosed the total number of affected individuals, the identity of the attackers, or whether any ransom demand was met.

The company has not described the initial access vector, the ransomware variant used, or the relationship between the data theft and the ransomware deployment. It has not said whether the stolen data has appeared on any criminal forum or been offered for sale.

Those unanswered questions are not unusual in the early stages of a breach notification, but they mean the public record of this incident is incomplete. The state filings provide a partial count of affected residents, and the notifications describe the categories of data taken, but the full scope remains undisclosed.

What This Means for Affected Individuals

People who receive an Advantest notification are being told that names, dates of birth, contact information, Social Security numbers, passport and driver's license numbers, and medical and financial information were taken. That is one of the more expansive combinations of personal data a breach notification can list.

Because Advantest has not said how many people are affected overall, the notification may be the only signal an individual gets that their data was involved. The state filings cover only residents of states that publish them, so someone outside California, Massachusetts, or Vermont may have no public indication that their information was part of the incident.

The company's statement that it has no information suggesting the data has been publicly disclosed or misused does not close the matter. Stolen personal data has a long shelf life, and the categories involved here are the ones that support identity fraud. Whether this particular dataset surfaces later, and in what form, is something only time and monitoring will reveal.