Analog Devices Discloses Data Breach After Hackers Stole Files in June Attack
The Massachusetts chip-maker told federal regulators that unauthorised intruders accessed its systems on 23 June and took files. A separate extortion group now claims to hold 570,000 records from the company.
Key points
- Analog Devices, a semiconductor company with roughly 24,000 employees and $12 billion in annual revenue, detected unauthorised access to its systems on 23 June 2026.
- The company filed a disclosure with the U.S. Securities and Exchange Commission (SEC) on Wednesday, as required under federal cybersecurity rules that took effect in 2023.
- Hackers stole files, but Analog Devices has not specified what kind of information was taken or how many people may be affected.
- An extortion group calling itself ExfilSquad separately claims to have stolen 570,000 records from the company; Analog Devices says it is still assessing that claim.
- The company says the breach did not disrupt its operations and no stolen files have been found circulating publicly.
Analog Devices makes the small electronic chips that sit inside industrial machinery, cars, and communications equipment. The company is publicly traded and based in Massachusetts. On Wednesday, it reported a security breach to the SEC, the federal agency that oversees public companies, in a filing that companies are now required to submit when they suffer a significant cyber incident.
What actually happened?
On 23 June, the company's security team detected intruders inside certain internal systems. Analog Devices brought in outside security experts to help investigate. Those experts confirmed that hackers had taken some files before being discovered.
The company says operations were never disrupted. As of the filing date, Analog Devices is not aware of the stolen files being published online or used against anyone. Under SEC rules, specifically the cybersecurity disclosure requirements that became mandatory in December 2023, public companies must report breaches they judge to be material, meaning significant enough to affect investors or the business. Analog Devices stated the incident does not meet that threshold for financial or operational impact.
Is there a second threat?
Yes, and this is the part Analog Devices is still working out. Buried in the same SEC filing is a separate, carefully worded sentence: the company says it was made aware, on 26 July 2026, of public reports about "a disparate cybersecurity matter" it is currently assessing.
That almost certainly refers to claims made by a group called ExfilSquad, which says it stole 570,000 records from Analog Devices. ExfilSquad focuses purely on stealing data rather than using ransomware, which is software that locks a victim's files until a ransom is paid. The group's public claims page has also listed Microsoft, the cities of Atlanta and Houston, and the UK Department of Education as alleged victims.
Importantly, security researchers at threat-intelligence firm SOCRadar noted this week that some of ExfilSquad's past claims appear exaggerated or fabricated. Analog Devices no longer appeared on ExfilSquad's website at the time of publication, first reported by SecurityWeek.
What should employees or customers watch for?
Analog Devices sells mainly to other businesses, not directly to consumers. Even so, employees and any individuals whose information may be held in company records should watch for unexpected emails that reference personal details, a common sign that stolen data is being used for follow-up phishing, where criminals send fake emails to trick people into handing over passwords or financial information.
If Analog Devices determines that personal data was taken, federal and state notification laws will require it to inform affected individuals directly.
| Detail | Information |
|---|---|
| Breach detected | 23 June 2026 |
| SEC filing date | Wednesday, July 2026 |
| ExfilSquad claim awareness date | 26 July 2026 |
| Records claimed stolen (ExfilSquad) | 570,000 |
| Operations disrupted | No |
| Files found circulating publicly | No |
Common questions
Do I need to do anything if I am an Analog Devices customer?
The company sells to industrial and commercial clients, not directly to individual consumers. If you work for a business that deals with Analog Devices, ask your own IT or security team whether any shared data could be involved, and watch for unusual emails referencing your organisation.
Why does a chip-maker have to tell the SEC about a hack?
Since December 2023, the SEC requires all publicly traded U.S. companies to disclose cybersecurity incidents that are material, meaning incidents that a reasonable investor would want to know about. The rule is designed to stop companies from burying breach news in footnotes years after the fact.
