Analog Devices: Cyberattack and Extortion Over 570,000 Records

Published on 31 July 2026

A semiconductor group with over 24,500 employees, more than 11 billion US dollars in annual revenue and customers in the automotive industry, medical technology as well as aerospace reports a hacker attack – and a previously unknown extortion group claims to have made off with no fewer than 570,000 records of customer data. That is exactly what came to light on 30 July 2026: Analog Devices, one of the world's largest manufacturers of analog and signal-processing chips, confirmed a cyberattack in a mandatory filing with the US Securities and Exchange Commission (SEC). What this means for German companies that do business with Analog Devices, and what you should now check specifically, is what we clarify in this article.

What happened?

On 23 June 2026, Analog Devices (NASDAQ: ADI) discovered unauthorised access to certain corporate systems. As the company stated in its SEC filing (Form 8-K), it immediately activated its incident-response protocols – these are predefined emergency procedures for security incidents – brought in external cybersecurity experts and notified law enforcement authorities. According to its own statements, business operations were not interrupted at any point.

The investigation found that attackers stole files from the affected systems (in technical terms: exfiltrated them). The official statement reads:

„On June 23, 2026, Analog Devices, Inc. identified unauthorized access to certain Company systems. […] The Company's investigation has found that certain files were exfiltrated from the affected systems. […] To the Company's knowledge, the data has not been publicly released or used for fraudulent purposes."
– Analog Devices, SEC Form 8-K, signed by Chief Legal Officer Janene I. Asgeirsson

Important: Exactly what kind of data was stolen is so far not officially known. Analog Devices merely confirms that files were leaked – whether customer data, employee data or intellectual property (such as chip designs) are affected remains open for now.

The second, separate incident: ExfilSquad

In parallel, and according to Analog Devices independently of the first attack, the group became aware on 26 July 2026 of public reports about a further incident. This is presumably the work of the newly emerged extortion group ExfilSquad. On its data-leak site operated within the Tor network (the anonymous part of the internet), it claims to have stolen roughly 570,000 records with customer PII and addresses. PII stands for "personally identifiable information", i.e. personal data by which a person can be identified.

Analog Devices is reticent about this second incident:

„Separately and unrelated, on July 26, 2026, the Company was made aware of public reports regarding a disparate cybersecurity matter and is currently assessing its validity, scope, and any potential impact."
– Analog Devices, SEC Form 8-K

Whether the ExfilSquad incident is identical to the breach of 23 June reported in the SEC filing, or represents a completely separate attack, remains unclear so far.

Who is ExfilSquad – and how credible are the claims?

ExfilSquad first surfaced on 26 July 2026 – and did so with an unusual bang: on that single day the group listed 15 victim organisations simultaneously on its leak site. Besides Analog Devices, these included high-profile targets such as Microsoft, Wesco International, the US cities of Atlanta and Houston, Frontier Airlines, the insurer Allstate and British authorities.

The group operates according to the so-called "exfiltration-only" model (also called "data broker" or "pure extortion"): unlike classic ransomware, ExfilSquad does not encrypt any files but exclusively steals data and threatens to publish it in order to extort a ransom. This model is less risky for attackers and harder to detect, because no conspicuous encryption activities trigger alarms.

Crucial for the assessment: the security firm SOCRadar explicitly urges caution regarding the group's claims.

„ExfilSquad is an emerging data-extortion group […]. Their listings remain highly questionable and may involve reused data or fabricated allegations, with fabrication currently appearing more likely based on the limited material available."
– SOCRadar, Dark Web Profile: ExfilSquad, 28 July 2026

SOCRadar also emphasises that ExfilSquad has provided no forensic evidence, no verifiable data samples and no independent confirmation of its claims. So far there are no confirmed technical traces (so-called indicators of compromise), no malware signatures and no known attack tools. In short: the figure of 570,000 records is a claim by the perpetrators – not a confirmed fact.

One further detail speaks volumes: Analog Devices was already removed from the ExfilSquad leak site again on 29 July. BleepingComputer reporter Bill Toulas interprets this as follows:

„However, the threat actor no longer lists Analog Devices on their site. While the reason for this is unknown, it is common for threat actors to delist companies when ransom negotiations begin."
– Bill Toulas, BleepingComputer, 30 July 2026

Who is affected?

Directly affected is, first of all, Analog Devices itself. For German small and medium-sized enterprises, the risk is indirect but quite real: if your company, as a customer, supplier or business partner of Analog Devices, has transmitted personal data (for instance of employees in procurement or of contact persons) to the group, this data could be part of the stolen files.

Since Analog Devices supplies chips in critical areas such as automotive, medical technology as well as aerospace, the circle of potentially affected business partners in Germany is large – from automotive suppliers through industrial automation providers to electronics developers.

How to check whether you are affected

1. Check the business relationship: Clarify whether your company is a customer, supplier or partner of Analog Devices and whether personal data (employee or customer data) was transmitted to Analog Devices in the process.
2. Wait for official communication: Analog Devices has announced that it will notify affected parties and authorities in accordance with applicable law. Check your emails and official channels for messages from analog.com.
3. Use dark-web monitoring: Free services such as Have I Been Pwned (haveibeenpwned.com) show whether company email addresses have appeared in data leaks.
4. Monitor leak sites: Threat-intelligence sources such as ransomware.live or SOCRadar track whether ExfilSquad posts new publications relating to Analog Devices.
5. Check internal systems: If you operate technical integrations or API connections (interfaces between software systems) to Analog Devices, review your access logs for anomalies in the period June to July 2026.
6. Follow SEC filings: Via the SEC EDGAR portal (CIK 0000006281, filing type 8-K) you can obtain updated official information on the scope of the data breach.

What you need to do now

1. Immediate measures for those directly affected: If you receive a notification from Analog Devices, document it and immediately inform your data protection officer (DPO).
2. Check GDPR notification obligation: If personal data of your customers or employees is affected, the 72-hour notification deadline under Art. 33 GDPR to the competent state data protection authority applies. In the case of a high risk to those affected, notification of the individuals under Art. 34 GDPR is also required.
3. Change credentials: Change all passwords for systems connected to Analog Devices, and activate two-factor authentication (2FA/MFA) everywhere – that is, a second security layer in addition to the password.
4. Increase phishing vigilance: Raise awareness among your employees. Stolen contact data and addresses are readily misused for targeted spear phishing (tailored fraudulent emails).
5. Ensure IT security hygiene: Patch all systems up to date, secure VPN access with MFA, and monitor unusually large outbound data volumes with network monitoring or DLP solutions (data loss prevention, i.e. software against data exfiltration).
6. Check backups: Make sure that current, encrypted and offline-stored backups exist and are tested regularly.
7. Assess supply-chain risk: Check all third-party providers with whom you share personal data for their security level and ensure that data processing agreements (DPA, Art. 28 GDPR) are in place.
8. Update the incident-response plan: Ensure a documented emergency plan that covers GDPR notification obligations, communication channels and immediate technical measures.

GDPR context: Why this is also relevant for SMEs

As soon as personal data is compromised, the GDPR applies. Two obligations are paramount:

• Notification obligation (Art. 33 GDPR): The controller must report a data breach to the competent supervisory authority "where feasible, not later than 72 hours" after becoming aware of it – in Germany the state data protection authorities.
• Notification of affected individuals (Art. 34 GDPR): If there is a high risk to those affected (e.g. identity theft), they must be informed without undue delay.

The fine risks are considerable: up to 10 million EUR or 2% of global annual turnover (lower tier) or up to 20 million EUR or 4% (higher tier) are possible. That authorities are by no means hesitant here is shown by the figures: in 2025 German data protection authorities imposed 249 fines with a total value of around 46.9 million EUR (including 45 million EUR against Vodafone). EU-wide, fines since the introduction of the GDPR up to March 2025 totalled around 5.65 billion EUR. SMEs are also in focus – frequent causes of fines are missing technical protective measures, inadequate service-provider contracts and delayed notifications.

One more note: in Germany in 2025 a total of 10,259 data breaches were reported – a clear increase compared with 8,623 in 2024. Data breaches are therefore long since no longer an exceptional case.

Context: The semiconductor sector in the crosshairs

The incident joins a series of attacks on chip manufacturers. Microchip Technology was hit by the Play ransomware group in 2024 (damage costs: 21.4 million USD), Applied Materials suffered an attack in 2023 with around 250 million USD in damages, and Foxconn was affected by an attack on North American plants in May 2026. James Reddick of Recorded Future News summarises:

„Globally, semiconductor companies have in recent years been the target of ransomware attacks and cyberespionage."
– James Reddick, The Record / Recorded Future News, 30 July 2026

Striking is the trend towards pure data extortion without encryption: according to Halcyon.ai, 96% of ransomware attacks in 2025/2026 involved data exfiltration – in the fastest 25% of attacks the exfiltration phase was reached in just 72 minutes. The motto "just steal, don't encrypt" makes attacks more efficient for the perpetrators and harder for defenders to detect.

Conclusion

Analog Devices confirms a genuine security incident with data exfiltration – that is a fact. ExfilSquad's claim about 570,000 stolen customer records, by contrast, is so far unconfirmed and, according to SOCRadar, possibly exaggerated or fabricated. The nature of the data actually affected is also not officially known, and whether it involves one or two separate attacks is unclear.

For German SMEs, this means: no reason to panic, but a good occasion for due diligence. If you maintain business relationships with Analog Devices, check now whether personal data was transmitted, watch out for official notifications and keep your GDPR processes ready. And quite fundamentally: the incident underlines once again that robust security hygiene – MFA, up-to-date patches, tested backups, a functioning emergency plan and clean service-provider contracts – is no longer a "nice-to-have" but the basic equipment of any company that processes personal data.

We will keep an eye on developments and update this article as soon as Analog Devices or the authorities publish new, confirmed information on the scope of the data breach.