MathWorks confirms ransomware attack behind MATLAB service outages

MathWorks, the Massachusetts company behind MATLAB and Simulink, was hit by ransomware on 18 May 2025. The attack knocked out a broad set of customer facing and internal systems and left users of the engineering software unable to reach services for more than a week.

Outages spread across the company's web and mobile applications, licensing infrastructure, software downloads, the online store, the main website, the wiki, user account services and staff systems. Single sign on and multifactor authentication were among the first functions restored. MathWorks did not initially say what had caused the disruption and only confirmed on 26 May that ransomware was behind it.

In a statement posted to its trust centre, the company characterised the intrusion as a financially motivated commodity ransomware attack rather than the work of a nation state, and said it had notified the FBI. No ransomware group publicly claimed responsibility, and MathWorks released no details about the attacker.

The company said it engaged outside cybersecurity experts, contained the incident and prioritised restoring MATLAB itself, which it puts at more than five million users worldwide. By 28 May a number of services were back, though SecurityWeek reported that several applications remained offline or were running with reduced functionality. MathWorks later said its forensic investigation was complete, that the last attacker activity was observed on 18 May, and that it found no indication its software or services had been compromised.