Short answer
Advantest began sending breach notices dated 6 October 2026 saying an unauthorized party extracted data from its servers after a February 2026 intrusion that involved ransomware. The company offers 18 months of free Kroll monitoring and says it has no information the data was misused.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Advantest Corporation |
|---|---|
| Incident type | Ransomware |
| Status | Confirmed by the organization |
| Sector | Semiconductor test equipment manufacturing |
| Country | Japan |
| Detected | 2026-02-15 |
| Disclosed | 2026-10-06 |
| People or records affected | Not disclosed. Advantest has not said how many people received notices or whether they are customers, employees or partners |
What data was exposed
- Contact information and date of birth
- Social Security number, national ID number, driver's license number and passport number
- Medical information and financial information
- Other ID numbers (the exact mix varies by person)
What happened
Advantest Corporation, a Japanese maker of automated test equipment for the semiconductor industry, has begun notifying people that their personal data was taken in a cyberattack earlier this year. The letter, dated 6 October 2026 and filed with the California Attorney General, says Advantest became aware of the incident in February 2026, when an unauthorized third party accessed its systems and extracted data from its servers.
BleepingComputer reported on 7 October that the intruder breached the network on 15 February. In its earlier disclosure, Advantest had said hackers reached parts of its network and deployed a ransomware payload, and that it could not yet tell whether customer or employee data was affected. The October letter is the first confirmation that personal data was among what was taken.
What the letter says was exposed
The notice lists these categories, and each recipient’s letter names those that apply to them:
- Contact information and date of birth
- Social Security number and national ID number
- Driver’s license and passport number
- Medical information and financial information
- Other ID numbers
The letter does not say who the affected people are. BleepingComputer asked Advantest how many individuals were involved and whether they were customers, employees or partners, and had received no answer when it published. No figure has been reported.
The company’s response
Advantest says it took potentially affected systems offline, added security measures, strengthened monitoring and reinforced internal controls. It says the incident was quickly contained and the network restored, and that it notified international authorities, including law enforcement. It reports no information suggesting the data has been disclosed publicly or misused, while acknowledging a higher risk of identity theft or fraud.
BleepingComputer found no ransomware group publicly claiming the attack as of its report. That means the ransomware label here comes from Advantest’s own earlier disclosure, not from a gang’s claim.
What help is offered
Advantest is offering 18 months of free credit and web monitoring from Kroll. Letters carry a membership number and a deadline of 4 January 2027 to activate. The company also recommends watching accounts and credit reports, reporting unknown transactions to a bank immediately, using unique passwords with two-factor authentication, and reporting suspected fraud to law enforcement.
Why this matters for scams
Social Security, passport and national ID numbers are among the most valuable identifiers for identity theft. Because notices ask people to enroll online, scammers can copy the format. Use only the link and phone number printed in your own letter, and compare any email with that letter before acting.
Start with our data breach checklist and read the guide to phishing messages. For another notification that arrived months after the attack, see the Frontline Education employee data breach.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails or texts that pretend to be Advantest or Kroll and ask you to 'activate monitoring' through a look-alike link.
- Identity theft attempts using a stolen Social Security, passport or national ID number, such as new credit applications.
- Medical or financial fraud that uses the exposed health and account details to sound credible.
- Calls offering to 'fix' your identity or remove data from the internet for a fee.
What to do if you are affected
- 01If you received a letter, enroll in the Kroll monitoring service with the membership number in your letter before 4 January 2027.
- 02Check your credit reports regularly for accounts or credit searches you do not recognize, and consider a credit freeze.
- 03Report any unknown transaction to your bank or service provider immediately.
- 04Do not click links or open attachments in unexpected messages, and never send money to someone you do not know.
- 05Call Advantest's Support Center at +1 (844) 301-0189 if you have questions about the notice, and do not trust numbers from unsolicited messages.
Frequently asked questions
What happened at Advantest?
Advantest says it became aware of a cybersecurity incident in February 2026 in which an unauthorized third party accessed its systems and extracted data from its servers. BleepingComputer reported that hackers deployed a ransomware payload after breaching the network on 15 February.
What personal information was involved?
The letter lists contact information, date of birth, Social Security number, national ID number, driver's license, passport number, medical information, financial information and other ID numbers. Each person's letter names the types that apply to them.
Has the data been leaked?
Advantest says it has no information that the data has been disclosed publicly or misused. BleepingComputer found no public claim of responsibility by a ransomware group when it published.
What help is offered?
Advantest offers 18 months of free credit and web monitoring from Kroll. Recipients have until 4 January 2027 to activate it.
Sources
- Advantest confirms personal information stolen in ransomware attack, BleepingComputer, 2026-10-07
- Notice of Data Breach (individual letter), California Attorney General, 2026-10-06
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.