MKS Instruments says February ransomware attack will clip $200M from revenue

Dive Brief:

MKS Instruments is expecting a 20% hit to quarterly revenue following a ransomware attack that disrupted its supply chain operations in February.
The Feb. 3 ransomware attack materially impacted the company's business systems, disrupting its ability to supply technology for semiconductor manufacturing and advanced electronics, President and CEO John Lee said Tuesday during the company’s quarterly earnings call. The incident also impacted the operation of its photonics and vacuum solutions divisions affecting its ability to process orders, ship products and provide customer service.
The attack will result in at least a $200 million hit to company revenue during the first quarter, the company said. Prior to the incident, MKS Instruments expected to report about $1 billion in revenue.

Dive Insight:

After discovering the ransomware incident, MKS Instruments said it decided to suspend operations at certain facilities, according to a Feb. 6 filing with the Securities and Exchange Commission.

“Today we are well into the recovery phase,” Lee said during the call. “We’ve begun starting up the effective manufacturing and service operations, and we expect these operations to be restored over the coming weeks.”

The company reported the incident to law enforcement and was investigating the full extent of the costs and how much could be recovered through cyber insurance, according to the filing.

CFO Seth Bagshaw said the company expects to substantially recover the lost revenue by the end of the second quarter.

MKS Instruments retained incident response specialists and notified law enforcement, according to the SEC filing.

The attackers encrypted business and manufacturing systems and may have stolen personal data, according to a filing with California regulators.

The company could not immediately confirm employee data was stolen, but said it was a possibility. The information may have included names, addresses, Social Security numbers, bank account and payment card information, health records, and information about compensation and other personal information.

The attack put a damper on what was otherwise robust financial performance in the fourth quarter of 2022, as MKS Instruments reported record quarterly revenue of $1.09 billion, a 42% increase over the prior-year period and exceeded the high end of its revenue guidance.