Advantest

Advantest, a Japanese manufacturer of automated test equipment for the semiconductor industry, disclosed a breach that occurred in February 2026. Public notification came in early October.

Roughly eight months separate the incident from the disclosure. Public reporting at the time of writing does not establish the number of people affected, the attacker, or the dwell time, and those gaps are marked here rather than filled.

Contact information, dates of birth, Social Security numbers, national ID numbers, driver's licence numbers, passport numbers, medical information, financial information and other identification numbers.

That is an exceptionally complete identity set, and the combination points to employee records rather than customer data. Medical information alongside passport and national ID numbers is the signature of an HR file: the documents collected at hire, plus occupational health, plus payroll.

Almost certainly staff, current and former, and in a multinational that means several national ID regimes at once. A passport number and a national identity number are long-lived documents that most people will not replace because an employer was breached.

There is a sector dimension too. Advantest makes test equipment for semiconductor manufacturing, which places it inside a supply chain under sustained state-level interest. Employee records from such a company support targeting as well as fraud.

Collecting this data is lawful and in most cases mandatory. An employer must verify identity and right to work, administer payroll and manage occupational health, and each of those obligations produces one of the fields in that list.

The gap is between collecting a document and retaining its full number indefinitely. Right-to-work verification needs to happen once, be recorded, and be auditable. Almost none of those requirements are satisfied better by keeping the passport number than by keeping the dated result of the check.

The eight-month interval answers this. An intrusion in February produced a disclosure in October, which means establishing who was in the affected systems took most of the year.

HR data is the hardest internal estate to inventory, because it is assembled over decades, spans jurisdictions with different retention rules, and sits in a mix of a core HR system, shared drives, scanned document stores and departmental spreadsheets.

This is the same shape as the Aesto Health entry in this series, where a sixteen-day intrusion produced a nine-month silence. The length of a disclosure timeline is a direct measurement of how well an organisation knew its own data before the incident.

A ransomware group is described in reporting but has not been named in the sources cited here, and Advantest has not published attribution.

The absence of a leak site listing in the available reporting, combined with an eight-month gap, is consistent with a quiet intrusion found later rather than an extortion event with a countdown.

Knowing which systems held employee identity documents, and reducing what was kept. The scale of the field list is the scale of the harm, and most of those fields had already served their purpose years earlier.

Second, closing the gap between incident and inventory. The eight months were spent discovering something that was true in February. An organisation that already knows where its HR records live notifies in weeks, which is also what most jurisdictions expect.