Data I/O shuts down systems in wake of ransomware attack
Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
You are now subscribed
Your newsletter sign-up was successful
Electronics manufacturer Data I/O has reported a ransomware attack that took place earlier this month.
Regulatory filings from the firm show it detected a breach of internal IT systems on 6th August.
"Upon discovery, the Company promptly activated its response protocols, took steps to secure its global IT systems and implemented containment measures, including proactively taking certain platforms offline and implementing other mitigation measures," it said.
"The Company also engaged leading cybersecurity experts to support the IT system recovery and conduct a comprehensive investigation,” the Data I/O added.
“Based on the findings, the Company will take additional actions as appropriate, including notifying affected individuals and regulatory authorities in compliance with applicable laws."
According to Data I/O, containment activities have hit IT systems relating to internal and external communications, shipping, receiving, manufacturing production, and various other support functions.
The company hasn't revealed whether it's received a ransomware demand. Similarly, it said there doesn't appear to have been any significant impact on the company’s business operations.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
However, Data I/O said it's likely that costs related to the incident, including fees for cybersecurity experts and other advisors, along with the cost of restoring any impacted systems, could have a material impact on its financial results.
Data I/O attack culprits still at large
Data I/O produces electronic device programming systems for integrated circuits, such as flash memory and microcontrollers, with customers including Tesla, Bosch, Amazon, Apple, Google, HP, Microsoft, Siemens, Philips, Sony, and Foxconn.
Around two-thirds of its business currently comes from automotive electronic production, including technology for electric car charging stations. It claims it serves 18 of the world's top 20 automotive electronics suppliers.
Pete Luban, Field CISO at AttackIQ, said given the domain Data I/O works in, it represents a prime target for threat actors.
"Ransomware attacks on manufacturers can have rippling effects down supply chains, especially with Data I/O’s major customers including industry giants like Tesla, Panasonic, Amazon, Google, and Microsoft," he said.
"Manufacturers should use this case as a lesson to enact proactive security measures to mitigate ransomware threats before they’re able to shut down critical systems."
Luban added that security teams should use adversarial emulation to test their defenses against baseline behaviors associated with common ransomware groups:
"This way, organizations can shut off access to sensitive systems and information and keep supply chains intact," he said.
No group has yet claimed responsibility for the attack. However, Scattered Spider or ShinyHunters are likely suspects.
"Given the geopolitics surrounding the chip industry and its high-profile customers, Data I/O is an attractive target for cyber criminals. With shipping delayed, the attack affects not only Data I/O but also the tech giants that rely on their chips to build their products," said Trevor Dearing, director of critical infrastructure at Illumio.
"By hitting critical systems, attackers drive faster payouts and cause deeper damage than traditional data breaches ever did. Ransomware now brings massive downtime, reputational harm, and financial loss."
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- Ransomware victims are getting better at haggling with hackers
- The ransomware groups worrying security researchers in 2025
- A major ransomware hosting provider just got hit US with sanctions
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
DIY hackers are turning to ‘flat-pack’ malware components to speed up attacks and cut costsNews While these malware campaigns are very basic, researchers noted “they still work”
-
Russian DDoS: what’s the threat to businesses?In-depth The UK National Cyber Security Centre (NCSC) has issued a warning that Russian-aligned hacktivist groups are targeting organizations
-
Using AI to generate passwords is a terrible idea, experts warnNews Researchers have warned the use of AI-generated passwords puts users and businesses at risk
-
Researchers called on LastPass, Dashlane, and Bitwarden to up defenses after severe flaws put 60 million users at risk – here’s how each company respondedNews Analysts at ETH Zurich called for cryptographic standard improvements after a host of password managers were found lacking
-
‘They are able to move fast now’: AI is expanding attack surfaces – and hackers are looking to reap the same rewards as enterprises with the technologyNews Potent new malware strains, faster attack times, and the rise of shadow AI are causing havoc
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacksNews Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
-
Ransomware gangs are sharing virtual machines to wage cyber attacks on the cheap – but it could be their undoingNews Thousands of attacker servers all had the same autogenerated Windows hostnames, according to Sophos
-
Google issues warning over ShinyHunters-branded vishing campaignsNews Related groups are stealing data through voice phishing and fake credential harvesting websites
-
Notepad++ hackers remained undetected and pushed malicious updates for six months – here’s who’s responsible, how they did it, and how to check if you’ve been affectedNews Hackers remained undetected for months and distributed malicious updates to Notepad++ users after breaching the text editor software – here's how to check if you've been affected.
-
CISA’s interim chief uploaded sensitive documents to a public version of ChatGPT – security experts explain why you should never do thatNews The incident at CISA raises yet more concerns about the rise of ‘shadow AI’ and data protection risks
