Advantest Confirms Data Extraction
Advantest’s 6 October notice confirms extracted personal data from its previously disclosed ransomware incident. It is not a new October attack report, and it gives no affected total.
Four dates answer different questions
California’s filing records 23 January as the known breach date. Advantest detected unusual activity on 15 February, Japan time. Its 4 March update still described data access or removal as under investigation. The October letter confirms extraction. Event, detection, public reporting and individual notification should not be collapsed into one timestamp.
The template lists contact details, dates of birth, government IDs, medical and financial information. Placeholders alone cannot establish your exposure. Advantest reported no information of public disclosure or misuse at notice time, not a future assurance.
Act on the letter you received
The offer is 18 months of Kroll credit and web monitoring, activated by 4 January 2027. Check your letter’s U.S. credit-service eligibility conditions.
BlackTree recommends verifying the notification through an independently located official Advantest contact before using its enrolment details. Do not borrow another person’s membership code or treat a forwarded letter as your own evidence. Keep the verified notice so that a later suspicious approach can be checked against what the company actually told you.
For U.S. credit protection, FTC guidance explains free freezes at all three credit bureaus. A freeze restricts new credit; monitoring flags changes. Review financial, credit and medical statements, and use unique passwords with two-step verification. That precaution is not evidence that passwords were extracted.
For example, a letter identifying a government identifier calls for a different response from one identifying contact details alone. BlackTree recommends recording the affected fields and the steps you actually completed, then asking the relevant institution about any unexplained activity rather than relying on an absence of alerts.
Copied identity data can remain useful after access has been closed. BlackTree’s Hasbro analysis explains why closing an account does not recover identity records that have already left an organisation. That comparison supports protective action, not a claim of a shared attacker or technique.
Sources: Advantest’s 19 February statement and 4 March update; the California attorney general’s SB24-630848 filing and individual notice.
Updated 15 October 2026: clarified the incident chronology, credit-service eligibility and protective guidance. The original publication date is retained.
