$250m ransom attack raises espionage fears

A third-party supply-chain cyberattack has robbed electronic chip manufacturer Applied Materials of a not-so-cool quarter of a billion dollars, the company reports.

Anti-malware provider Malwarebytes said it believed the ransomware attack responsible for the unwelcome ripple effect was the one carried out on MKS Instruments, which disclosed the breach on February 16.

Applied Materials did not itself name the supplier, but said that its second-quarter sales were likely to suffer a $250 million dip after a third-party breach.

The attack has further ramifications apart from slashed profits – Malwarebytes emphasized that semiconductor manufacturing equipment, often referred to simply as “chips”, is a “specialized and espionage-sensitive industry where a few companies dominate the global market”.

The data breach notice filed by MKS said it had led to sensitive employee data being “made available to an unauthorized party”, said Malwarebytes, adding that the supplier’s ability to process orders, ship products, and provide customer service had been hampered by the attack.

“The full scope of the costs and related impacts of this incident, including the extent to which the company’s cybersecurity insurance may offset some of these costs, has not been determined,” it added.

Supply-chain attacks are increasingly favored by threat actors in the ransomware community, as they can be a way to catch a larger entity off-guard by going after an interconnected smaller party.

“A supply-chain attack is, essentially, another way for attackers to compromise their target company,” said Malwarebytes. “Instead of them attacking their target directly, they go for the weakest link in that company’s supply chain: a vendor that may not have as secure a system as their main target.”

The cybersecurity firm urges potential targets to anticipate such attacks by creating backup systems that are offsite and offline, as well as preparing an incident response plan that details in advance measures employees should take to “isolate an outbreak, communicate with stakeholders, and restore your systems”.