US chip testing firm shrugged off ransomware hit as minor – then came the data leak
Trio-Tech International initially said hack wasn't 'material,' but then stolen data was published
Trio-Tech International initially shrugged off a ransomware attack at a Singapore subsidiary as immaterial, only to reverse course days later after discovering stolen data had been disclosed.
The California-based semiconductor testing and burn-in services outfit said it detected a ransomware incident at a Singapore subsidiary on March 11, which led to the encryption of "certain files" on the company's network. Trio-Tech initially concluded the disruption wasn't material, but that assessment aged about as well as milk.
"On March 18, the incident escalated and resulted in the unauthorized disclosure of certain Company data," the company said in an 8-K filing with the SEC. "Following this development, management concluded that the incident may constitute a material cybersecurity event."
Trio-Tech International sits in the nuts-and-bolts end of chipmaking, running testing and burn-in services that make sure components don't fail in the field. It works with customers in automotive, industrial, and computing, and has operations across the US and Asia, including Singapore, Malaysia, Thailand, and China.
In its SEC filing, the company said it activated its incident response plan as soon as the issue was identified, taking systems offline and calling in outside cybersecurity help. Law enforcement in Singapore has been notified, and the process of contacting potentially affected individuals is underway, although Trio-Tech says it is still figuring out exactly what data was caught up in the mess.
So far, Trio-Tech is saying the business remains largely unscathed. Despite saying it now "may" consider the cybersecurity event itself to be "material," it told regulators that when it comes to operations, the incident hasn't caused "material disruption." Most importantly for the suits (won't somebody think of the shareholders), it claims it doesn't expect it to significantly impact financial results for the quarter ending March 31. That may prove optimistic.
Ransomware crews increasingly pair encryption with data theft to crank up pressure on victims, and what starts as a contained systems issue can turn into a disclosure problem once stolen data enters the picture. It's not yet clear which crew was behind the attack on Trio-Tech, and none of the usual groups have yet claimed responsibility.
Trio-Tech has not said what data may have been taken, whether a ransom was demanded, or if any payment was made. The company is working with its cyber insurance provider as it investigates and recovers systems, with the eventual financial or other impacts likely to take longer to come into focus. ®