Analog Devices Confirms Cyberattack After Hackers Exfiltrate Files From Company Systems

Analog Devices, Inc. has confirmed that unauthorized actors gained access to certain company systems and exfiltrated files.

The semiconductor manufacturer detected the cyber incident on June 23, 2023, and immediately activated its incident response protocols.

The company enlisted external cybersecurity experts to assist with containment and forensic investigations and notified law enforcement authorities. According to Analog Devices, its operations were not interrupted during the incident.

Analog Devices Confirms Cyberattack

While this disclosure confirms that data theft occurred, the company did not identify the threat actor, disclose the intrusion method, or specify which systems and network environments were affected.

The ongoing investigation revealed that “certain files” were taken from the impacted systems; however, Analog Devices has not yet determined the full nature and scope of the exfiltrated information, as stated in a Form 8-K it filed with the U.S. Securities and Exchange Commission.

They did not specify whether the stolen files contained employee, customer, supplier, intellectual property, financial, engineering, or operational data.

As of the filing, the company stated that it had no evidence that the data had been publicly released or used for fraudulent purposes.

Analog Devices will continue to monitor for signs of misuse and has committed to taking appropriate action if any indicators of malicious activity arise. Furthermore, they vowed to notify affected parties and relevant regulators as required by law.

Based on the information currently available and the containment measures implemented after the discovery, Analog Devices believes that the June cyberattack is unlikely to affect its business, operations, or financial condition materially.

However, this assessment may change as the investigation progresses, especially if the stolen material includes sensitive proprietary data, regulated personal information, or information related to customers and supply-chain partners.

For a major semiconductor company, theft of design documentation, product roadmaps, manufacturing information, source code, or partner data could create long-term security, competitive, and operational concerns, even if production systems remain unaffected.

The SEC filing also mentions a separate cybersecurity matter reported publicly on July 26, 2023. Analog Devices described this event as “disparate” and unrelated to the June 23 intrusion.

The company is assessing the validity, scope, and potential impact of these public reports but provided no further details. It remains unclear whether these reports involve a data leak, a separate allegation of unauthorized access, or activities linked to a known ransomware or extortion group.

This incident underscores the ongoing targeting of semiconductor and advanced-technology firms by cybercriminals and espionage-related actors seeking valuable intellectual property and enterprise data.

Organizations in the sector should prioritize rapid detection of unusual access, enforce phishing-resistant multi-factor authentication, segment high-value engineering and business systems, and monitor outbound traffic for potential data exfiltration. Analog Devices has not provided a timeline for completing its investigation or releasing further technical details.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.