Ransomware at MKS Instruments halted production at some facilities

MKS Instruments, a Massachusetts company that makes process control instrumentation and subsystems for semiconductor and electronics manufacturing, told the Securities and Exchange Commission that it identified a ransomware event on February 3, 2023 and immediately activated its incident response and business continuity protocols.

The company said the incident affected certain business systems, including production-related systems, and that as part of the containment effort it elected to temporarily suspend operations at certain of its facilities. It notified law enforcement and engaged outside incident responders while working to restore systems.

MKS said the full scope of the costs and related impacts had not been determined, and that it was still assessing how much of the loss its cybersecurity insurance would cover. The disruption also forced it to reschedule its fourth quarter and full year 2022 results to late February.

No ransomware group publicly claimed the attack. The disruption later proved costly. MKS reported at least $200 million in lost revenue tied to its Vacuum Solutions and Photonics Solutions divisions, and its customer Applied Materials attributed a $250 million shipment shortfall to a cyberattack at a supplier.