MalwareManufacturingTechnologyManufacturingRansomwareData ExfiltratedRansom DemandedData EncryptedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDCredentialsFinancial accountEmploymentHealth (basic)MediumActive

MKS Instruments, Inc

bd_10609a6a1a76f030 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 13, 2023

Filed

Feb 15, 2023

To disclose

2 days

Affected

203state residents only

Linked

8 filings

Confidence

66%

Full breach record for MKS Instruments, Inc →2 incidents on file

MKS Instruments, Inc. notified the NH AG of a ransomware event detected on Feb 13, 2023, affecting systems since Feb 3, 2023. The incident involved encryption of business/manufacturing systems and potential exfiltration of employee personal data (PII, SSN, credentials, financial info). 203 NH residents were notified on Feb 16, 2023. MKSI engaged forensic experts, reset passwords, deployed MFA, and installed Sentinel One. Identity monitoring offered for 2 years.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 11 days

discovery → filing · ≤1 day / 1 days

Feb 3, 2023

Begins

Feb 13, 2023

Discovered

Feb 15, 2023

Filed

This filing is one of 8 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_7ab949b29245ba5a2023-02-15Candidate
Massachusetts State AGbd_8661f29e3cdb8e162023-02-15Verified
Maine State AGbd_40fb17ba9f50a3042023-02-16 · +1dCandidate
Indiana State AGbd_469c34ddf4169c5b2023-02-16 · +1dVerified

Show 3 more filings ↓up to 9d gap

Montana State AGbd_488d1bfaf6139cd52023-02-16 · +1dVerified
SEC 8-Kbd_91e20ee0c300cf702023-02-13 · +2dVerified
SEC 8-Kbd_a88f0c343179b8322023-02-06 · +9dVerified

Name: MKS Instruments, Inc
norm: mks instruments
Domain: mksinst.com

Name: MKS Instruments, Inc
norm: mks instruments
Domain: mksinst.com
Industry: ManufacturingllmTechnologyllm

Discovered: Feb 13, 2023
Breach occurred: Feb 3, 2023
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 16, 2023
Affected individuals: 203state-resident count only
Data types: Identity (basic)Government IDCredentialsFinancial accountEmploymentHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: reported the issue to U.S. law enforcement

During the incident: Activated its incident response and business continuity protocols to contain the incident
Initiated an ongoing investigation, alongside outside experts
Reported the issue to U.S. law enforcement
Issued a public statement regarding the incident
Temporarily suspended certain operations
Restoring various systems
Required all personnel to change their work account passwords
Reset system passwords twice
Reset all user passwords, including service accounts
Deployed Multi-Factor Authentication for local Multi-Factor Authentication to servers
Installed Sentinel One for additional monitoring
Engaged third-party experts to assist with forensics, containment activities and restoring the network environment in a secure manner
Taking steps to scan the dark web for indications of any third parties offering access to data that may have been exfiltrated
Changes made: Deployed Multi-Factor Authentication for local Multi-Factor Authentication to servers
Installed Sentinel One for additional monitoring
Engaged third-party experts to assist with forensics, containment activities and restoring the network environment in a secure manner
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 2 days(2 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 6 states

View merged incident ↗

SEC 8-KFeb 6 · first

SEC 8-K+7d

California State AG+9d

Massachusetts State AG+9d

New Hampshire State AG+9d · this page

Maine State AG+10d

Indiana State AG+10d

Montana State AG+10d

Pattern: first filing Feb 6, last Feb 16 (MT) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mks-instruments-20230215.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 15, 2023
Raw hash: 6f0452f215898538a516aa65b249e5cffcfe269989a4ec0470c36e189483d4b8

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityMKS Instruments, Inc

Victim entityMKS Instruments, Inc

Incidentdiscovered Feb 13, 2023

Stated responseActivated its incident response and business continuity protocols to contain the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov