U.S. chipmaker Microchip says hackers stole employees' sensitive personal information

American semiconductor company Microchip Technology said sensitive personal information of its employees was accessed and stolen during the data security incident it suffered in August.

 

In a filing with the U.S. Securities and Exchange Commission in August, Microchip Technology said that on August 17, it identified suspicious activity in its internal network and immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

The U.S. chipmaker said it took steps to contain the incident and secure the affected portion of its network. The ransomware attack, however, affected its manufacturing facilities, forcing them to operate “at less than normal levels” which, in turn, affected Microchip’s ability to fulfill orders.

 

The Play ransomware group later claimed responsibility for the cyber attack and listed Microchip as a victim on its data leak site. The group claimed to be in possession of private and personal confidential data, clients’ documents, budget, payroll & accounting data and more.

 

In a fresh filing with the SEC, Microchip said its investigation has revealed that the sensitive personal information of its employees was compromised during the data security incident.

 

“While the investigation is continuing, the Company believes that the unauthorised party obtained information stored in certain company IT systems, including, for example, employee contact information and some encrypted and hashed passwords,” reads the SEC filing.

 

Microchip added that it has not identified any customer or supplier data being accessed or stolen by the hacker group.

 

The company continues to investigate the incident, with assistance from external cyber security experts, to determine the scope of the same. It has also notified all affected employees, law enforcement, and regulators about the incident.