In February 2023 ransomware stopped order-taking and shipping at a supplier inside the chip equipment industry. The $200M everyone quotes was a one-quarter revenue forecast MKS said it would recover. The disclosed cost was $15M.
Nothing in the MKS record says a machine was reached. The filings describe business systems, including “production-related systems” and the enterprise resource planning systems, encrypted by ransomware; the damage is to orders, shipping and service. The one division that kept running was Atotech, bought six months earlier. That its separate history is the reason is BlastWave’s analysis, not a disclosed fact.
The $200M was never a loss but an expected hit to one quarter’s revenue, with a commitment to recover it. On its calls MKS put the actual hit at about $160M, $120M of it back within a quarter. The disclosed cost was $15M, net of recoveries. Applied Materials built a $250M estimate into its outlook for an event at “one of our suppliers” it never named; analysts named MKS. If they are right, adding the two counts the same stalled shipments twice. What the case shows is concentration: toolmakers with different badges wait on the same few suppliers.
What is not known: No MKS filing names an attacker, an initial access vector or the malware, says how ransomware on business systems stopped production, or defines “production-related systems.” Which facilities were suspended, and for how long, is undisclosed, as is the cost before recoveries. MKS’s call figures, $160M actual and $120M recovered, were never filed. Applied Materials never named the supplier behind its $250M estimate and never reported what it came to.
Recommendation
Take the path away from the factories Order processing, ERP and production scheduling should not be reachable from the business network, so an intrusion in email and file shares finds no route to them.
Remove standing access to production Access to planning and production systems should be named, time-bound and approved. How the actors got into MKS is undisclosed; the control stands on its own.
Read production one way Reporting that only consumes production data should get it over a one-way path, and a paper order-and-ship path should be rehearsed for customers who cannot wait.
Sources: Form 8-K, 6 Feb 2023 (Item 8.01); Form 10-K FY2022, 14 Mar 2023; Q1 2023 results, 8-K Ex. 99.1, 3 May 2023; Earnings calls, 3 May and 2 Aug 2023; FY2023 results, 8-K Ex. 99.1, 7 Feb 2024; Applied Materials, 8-K Ex. 99.1, 16 Feb 2023.. Full list with links.
Soft Spots: The $160M actual hit and $120M recovery are MKS call remarks, read in transcript; no filing states them. Applied’s supplier as MKS is analysts’ inference, as reported. Why Atotech was spared is BlastWave’s analysis.
The full record
Every claim numbered to its source. Last updated .
Ransomware stopped order-taking and shipping at a supplier inside the chip equipment industry, and two forecasts became the most quoted numbers in the story. What is verified, what is only reported, and what is still unknown.
Summary
In February 2023, ransomware encrypted business systems at MKS Instruments, a supplier of subsystems for chipmaking equipment, halting order processing and shipping in two of its three divisions and suspending operations at certain facilities. No filing says any machine was reached. The widely quoted $200M was expected lost first-quarter revenue; the disclosed cost was $15M, net of recoveries.1,2,5,8
Timeline of the MKS Instruments ransomware incident
Every date is tied to a source. Press reporting appears only as evidence of what was said.
MKS completes its acquisition of Atotech, which it goes on to operate as its Materials Solutions Division.5,9
MKS identifies that it has become subject to a ransomware event.1
MKS files a Form 8-K under Item 8.01: the incident has affected "certain business systems, including production-related systems," operations at certain facilities are temporarily suspended as containment, and law enforcement has been notified.1
MKS postpones its results to 27 February and reports a "material impact" in the first quarter on its ability to process orders, ship products and provide service in its Vacuum Solutions and Photonics Solutions Divisions. The Materials Solutions Division is not impacted. The same day, MKS learns that the ransomware actors may have exfiltrated personal information.2,5
Applied Materials builds "a negative estimated impact of $250 million dollars related to a cybersecurity event recently announced by one of our suppliers" into its next-quarter outlook. It does not name the supplier.10
The Record reports that several industry analysts said the supplier was MKS Instruments, and that Applied did not respond to requests to confirm.14
MKS reports fourth-quarter 2022 results: before the ransomware event it had expected first-quarter revenue of about $1 billion, and it now estimates the impact on first-quarter revenue at "at least $200 million." The same day it files a Form 12b-25 citing the unavailability of its enterprise resource planning systems.3,4
MKS files its annual report: "We expect this incident will have a negative impact on our revenue for the first quarter of 2023 of at least $200 million."5
First-quarter revenue is $794 million. MKS says it has restored its global operations and is on track to substantially recover revenue by the end of the second quarter. Incident costs for the quarter, net of recoveries, are $7 million. On its earnings call, MKS puts the actual first-quarter revenue hit at about $160 million.6,13
Applied Materials reports quarterly revenue of $6.63 billion. The release does not mention a supplier, a cybersecurity event or the $250 million.11
Second-quarter revenue is $1,003 million; incident costs, net of recoveries, are $4 million for the quarter. On its earnings call, MKS says it recovered $120 million of the roughly $160 million affected, with about $30 million more expected in the third quarter.7,13
MKS reports incident costs of $15 million for 2023, net of recoveries.8
MKS's annual report for 2023 gives net costs of "approximately $15 million" and says the company was "previously subject to two lawsuits."8
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
What systems were affected?
Business systems "including production-related systems," and the enterprise resource planning systems1,4
Verified
Were machines or control systems reached?
No filing says so. "Production-related systems" is never defined1
Not on the record
Which divisions were hit?
Vacuum Solutions and Photonics Solutions. Materials Solutions "not impacted"2
Verified
Who did it?
Not named in any filing; no claim for the 2023 event located as of late September 2026
Undisclosed
How did they get in?
Not described in any filing or statement
Undisclosed
The $200 million
An expected hit to first-quarter 2023 revenue of "at least $200 million," with a commitment to recover it3,5,6
Verified (a forecast)
Actual first-quarter revenue hit
About $160 million, per MKS on its 3 May 2023 earnings call13
Company call remark, not filed
Revenue recovered
$120 million in the second quarter, about $30 million more expected in the third, per MKS on its 2 August 2023 call13
Company call remark, not filed
Disclosed cost
$15 million for 2023, net of recoveries. Gross cost undisclosed8
Verified
Was Applied Materials' supplier MKS?
Applied never named it. Analysts named MKS10,12,14
Reported only (analysts' inference)
Did Applied report what the $250 million came to?
No. Its next results release does not mention it11
Verified
Time to restore operations
Global operations restored by 3 May 2023, three months after identification6
Verified
Did the MKS ransomware incident reach factory machines?
Nothing in the MKS record says a machine or control system was reached. The 6 February 2023 Form 8-K says the incident affected "certain business systems, including production-related systems," and that MKS temporarily suspended operations at certain of its facilities as part of containment.1 The late-filing notice of 27 February names "certain information technology systems, including the Company's enterprise resource planning systems."4 The annual report states the mechanism:
"ransomware actors encrypted certain of our systems by deploying malware."
The damage the filings describe is to the ability to process orders, ship products and provide service, in the Vacuum Solutions and Photonics Solutions Divisions.2 Which facilities were suspended, and for how long, is undisclosed. That places the incident as an IT compromise halting physical operations, with one caveat: the filings never say what a "production-related system" is, and no filing describes equipment or control systems being affected.
Did ransomware cost MKS Instruments $200 million?
No. The $200 million was an expected hit to one quarter's revenue, stated before the quarter closed, with a commitment to recover it. MKS first gave the figure on 27 February 2023: before the event it had expected first-quarter revenue of about $1 billion, and it estimated the impact at "at least $200 million."3 The annual report repeated it:
"We expect this incident will have a negative impact on our revenue for the first quarter of 2023 of at least $200 million."
Three labels travel with that number: expected, revenue, first quarter. On 3 May 2023 MKS reported first-quarter revenue of $794 million and said it was on track to meet its commitment to "substantially recover revenue by the end of the second quarter."6 Second-quarter revenue was $1,003 million.7 No filing states that the revenue was recovered. MKS gave its own account of the actual figures on its earnings calls:
"We estimate the negative impact to revenue was approximately $160 million for the quarter ... relative to our initial expectations of at least $200 million impact"
On the 2 August 2023 call MKS said it recovered $120 million of the roughly $160 million in the second quarter, and that its third-quarter outlook included about $30 million more it expected to recover.13 Those are call remarks, not filings. The fall from a record fourth quarter of $1.09 billion to $794 million is not the incident's impact either; MKS's own pre-incident expectation was about $1 billion.3,6
What the filings disclose is cost: $7 million in the first quarter and $4 million in the second, net of recoveries, and $15 million for 2023 as a whole.6,7,8 Every MKS cost figure is net of recoveries. The gross cost, and where the recoveries came from, are not stated.
Did Applied Materials lose $250 million because of the MKS incident?
No. Applied Materials built a $250 million estimate into its outlook for a supplier it never named, and never reported what the impact came to. Its 16 February 2023 results release gave second-quarter fiscal 2023 guidance of about $6.40 billion, plus or minus $400 million:
"which includes ongoing supply chain challenges and a negative estimated impact of $250 million dollars related to a cybersecurity event recently announced by one of our suppliers."
Applied's word is "cybersecurity event," not ransomware. A full-text search of Applied's SEC filings from 2023 to late September 2026 for "MKS Instruments" returns no results.12 The identification came from industry analysts quoted by The Record on 17 February 2023, which also reported that Applied did not respond to requests to confirm it.14 The same report quoted Applied's chief executive on the earnings call:
"one of our major suppliers encountered a disruption that will impact our second-quarter shipments."
The identification is a good inference: MKS had disclosed its ransomware event ten days earlier, and MKS's annual report lists Lam Research and Applied Materials as its top two customers in 2022, together about 24% of its net revenues.1,5 It is still an inference. On 18 May 2023 Applied reported revenue of $6.63 billion for that quarter, above its own outlook midpoint, and the release does not mention a supplier, a cybersecurity event or the $250 million.11
Can the $200 million and the $250 million be added together?
No. Both are forecasts of revenue, and if Applied's supplier was MKS they describe the same stalled shipments from both ends. The $200 million is the revenue MKS expected not to book in its first quarter because it could not process orders and ship parts.5 The $250 million is the equipment revenue Applied expected not to book in its fiscal second quarter (the quarter ended 30 April 2023), which overlaps with, but is not the same as, MKS's calendar first quarter.10 Adding them counts one delay twice, at two price points.
Headlines turned the forecasts into losses. ThreatDown's 19 February 2023 post was titled "Chip company loses $250m after ransomware hits supply chain."15 Applied did not report a loss; it reported a quarter above its own midpoint.11
Why did one MKS division keep running?
MKS has not said. On 13 February 2023 the company stated that the incident had not impacted the operations of its Materials Solutions Division.2 The annual report identifies that division as Atotech, which MKS acquired on 17 August 2022, about six months before the incident.5,9
"The incident has not impacted the operations of the Company's Materials Solutions Division."
That the division's separate systems history as a recent acquisition is the reason is BlastWave's analysis, not a disclosed fact.
What is still not known about MKS Instruments
Who the attackers were. No MKS filing names a group, and no claim for the February 2023 event was located in the record read as of late September 2026.
How the attackers got in, and which malware family was used.
How ransomware on business systems stopped production, and what "production-related systems" means.1
Which facilities were suspended, and for how long.
The cost before recoveries, and where the recoveries came from.8
Whether any filing states the actual first-quarter revenue hit. MKS's figures (about $160M actual, $120M recovered in the second quarter) were given on earnings calls.13
Which supplier Applied Materials meant, and what its $250M estimate came to.10,11
Why the Materials Solutions Division was not impacted.
Claims about MKS Instruments the record does not support
Widely repeated claim
What the record says
"Chip company loses $250m after ransomware hits supply chain."
Applied Materials built a $250M estimate into its next-quarter outlook. It reported no loss, and its next results release does not mention the estimate.10,11,15
"Semiconductor industry giant says ransomware attack on supplier will cost it $250 million."
Applied said "cybersecurity event," not ransomware, and gave an estimated impact on its outlook. It never named the supplier; analysts did.10,12,14
Was personal data taken, and were there lawsuits?
MKS said personal information may have been exfiltrated, and lawsuits followed. The annual report for fiscal 2022 says MKS became aware on 13 February 2023 that the ransomware actors may have exfiltrated personal information, and that a class action was filed on 3 March 2023.5 The annual report for 2023 says MKS was "previously subject to two lawsuits."8 The outcomes of those suits are not covered in this entry.
BlastWave analysis: the supplier everyone waits on
Analysis, not a disclosed fact
Nothing on the record says an attacker reached a machine. What stopped shipments, on our reading of the filings, was the loss of the systems that process orders and tell the plants what to ship. Operations were suspended as containment, and the damage the filings describe is to orders, shipping and service.1,2,4 Why the division acquired six months earlier kept running is undisclosed; that its separate history is the reason is BlastWave's analysis, not a disclosed fact.
What the case does show is concentration. Toolmakers with different badges wait on the same few subsystem suppliers, and MKS's two largest customers together made up about a quarter of its 2022 revenue.5 A supplier's fallback is part of every customer's. Applied Materials built a supplier's cybersecurity event into a forecast without ever naming the supplier.10
Podcast: “The Truss Shop” (9:40). Joe Baxter and Cam Cullen on why the two famous numbers are forecasts of revenue, and why they cannot be added.
Video: MKS Instruments Short (60 to 90 seconds).
Frequently asked questions
What happened in the MKS Instruments ransomware attack?
On 3 February 2023 MKS Instruments, a supplier of subsystems for semiconductor equipment, identified a ransomware event. Its 6 February 8-K said business systems, "including production-related systems," were affected and operations at certain facilities were suspended. Order processing, shipping and service were hit in two of three divisions. MKS said on 3 May 2023 that it had restored its global operations.
Did ransomware cost MKS Instruments $200 million?
No. In February and March 2023 MKS said it expected the incident to reduce first-quarter 2023 revenue by at least $200 million, and committed to substantially recover that revenue by the end of the second quarter. That is a revenue forecast, not a cost. MKS reported incident costs of $15 million for 2023, net of recoveries, in its results of 7 February 2024.
How much revenue did MKS actually lose and recover?
On its 3 May 2023 earnings call MKS put the actual first-quarter revenue hit at about $160 million. On its 2 August 2023 call it said $120 million of that was recovered in the second quarter, with about $30 million more expected in the third. These figures come from call transcripts republished by MarketBeat; no MKS filing states them.
Was Applied Materials hacked or did it lose $250 million?
Neither is on the record. On 16 February 2023 Applied Materials included a negative estimated impact of $250 million in its next-quarter outlook, for a cybersecurity event announced by one of its suppliers. That is a forecast input, not a loss. Applied's 18 May 2023 results reported $6.63 billion in revenue and did not mention the supplier or the $250 million.
Was MKS the supplier Applied Materials was talking about?
Applied Materials never named the supplier, and a search of its SEC filings from 2023 to late September 2026 finds no mention of MKS Instruments. Industry analysts named MKS, as The Record reported on 17 February 2023, adding that Applied did not respond to requests to confirm. It is a reasonable inference, since MKS disclosed ransomware ten days earlier, but it remains an inference.
Who was behind the MKS Instruments ransomware attack?
No one has been publicly identified in the record read. No MKS filing names a group, no government has attributed the incident, and no claim for the February 2023 event was located in the record read as of late September 2026. MKS said only that ransomware actors encrypted certain of its systems by deploying malware. How they got in and the malware family are undisclosed.
Did the MKS ransomware reach factory machines or control systems?
No filing says so. MKS's filings describe business systems, including "production-related systems," and its enterprise resource planning systems, and the damage they describe is to processing orders, shipping products and providing service. MKS suspended operations at certain facilities as containment. The term "production-related systems" is never defined, and no filing describes equipment or control systems being reached.
Primary sources are MKS Instruments' and Applied Materials' own SEC filings and releases. Earnings-call remarks are cited from transcript republication and labeled as such; press is cited only as evidence of what was said.
Company filingMKS Instruments, Form 8-K, Item 8.01, filed 6 February 2023 (accession 0001193125-23-024904). sec.gov
Company filingMKS Instruments, Form 8-K and Exhibit 99.1, 13 February 2023 (accession 0001193125-23-034334): results postponed; impact on the Vacuum Solutions and Photonics Solutions Divisions. sec.gov · Form 8-K
Company filingMKS Instruments, Form 8-K, Exhibit 99.1, "MKS Instruments Reports Fourth Quarter And Full-Year 2022 Financial Results," 27 February 2023 (accession 0000950170-23-004673). sec.gov
Company filingMKS Instruments, Form 12b-25 (NT 10-K), 27 February 2023 (accession 0000950170-23-004684). sec.gov
Company filingMKS Instruments, Form 10-K for fiscal year 2022, filed 14 March 2023 (accession 0000950170-23-007851): Item 1 and Item 1A. sec.gov · investor.mks.com
Company filingMKS Instruments, Form 8-K, Exhibit 99.1, first-quarter 2023 results, 3 May 2023 (accession 0000950170-23-017248). sec.gov · investor.mks.com
Company filingMKS Instruments, Form 8-K, Exhibit 99.1, second-quarter 2023 results, 2 August 2023 (accession 0000950170-23-037239), and Form 10-Q for the quarter ended 30 June 2023, filed 4 August 2023 (accession 0000950170-23-038457). sec.gov · Form 10-Q
Company filingMKS Instruments, Form 8-K, Exhibit 99.1, fourth-quarter and full-year 2023 results, 7 February 2024 (accession 0000950170-24-012251), and Form 10-K for fiscal year 2023, filed 27 February 2024 (accession 0000950170-24-021071). sec.gov · Form 10-K FY2023
CompanyMKS Instruments, "MKS Instruments Announces Closing of Atotech Acquisition," 17 August 2022. investor.mks.com
Company filingApplied Materials, Form 8-K, Exhibit 99.1, "Applied Materials Announces First Quarter 2023 Results," 16 February 2023 (accession 0000006951-23-000007): Business Outlook. sec.gov
Company filingApplied Materials, Form 8-K, Exhibit 99.1, "Applied Materials Announces Second Quarter 2023 Results," 18 May 2023 (accession 0000006951-23-000017). sec.gov
FederalSEC EDGAR full-text search, run 24 September 2026 and repeated 28 September 2026: Applied Materials (CIK 0000006951) filings, 2023 to September 2026, for "MKS Instruments": 0 results; for "cybersecurity event": 2 (the 16 February 2023 release and the 10-Q filed 23 February 2023). MKS (CIK 0001049502) filings for "substantially recovered": 0.
CompanyMKS Instruments, first-quarter 2023 earnings call, 3 May 2023, and second-quarter 2023 earnings call, 2 August 2023, transcripts as republished by MarketBeat. Call remarks, not filings. marketbeat.com · Q2 call
PressThe Record (Recorded Future News), Jonathan Greig, "Semiconductor industry giant says ransomware attack on supplier will cost it $250 million," 17 February 2023. Cited as evidence of what was said. therecord.media
PressThreatDown (Malwarebytes), Pieter Arntz, "Chip company loses $250m after ransomware hits supply chain," 19 February 2023. Cited as an example of the headline construct. threatdown.com
Cite this page
BlastWave. “MKS Instruments Ransomware Incident (2023): What Is Verified.” Hackopedia, Volume 2, FILE 037. Last verified 28 September 2026. https://hackopedia.blastwave.com/manufacturing/mks-instruments-2023/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 037 in Hackopedia Volume 2, in the Manufacturing edition.
28 Sep 2026
Hand-check: the late-filing notice's wording on the enterprise resource planning systems re-read at the SEC; the search of Applied Materials' filings for "MKS Instruments" re-run (no results); ransomware leak-site trackers checked for a claim on the February 2023 event (none found).
26 Sep 2026
Full validation against SEC filings and dated publications. Added MKS's own earnings-call figures for the actual first-quarter revenue hit (about $160M) and the revenue recovered in the second quarter ($120M), labeled as call remarks. Cost figures stated as net of recoveries, as filed, without assuming their source.
24 Sep 2026
Volume 2 entry built from primary sources: MKS Instruments' and Applied Materials' SEC filings and releases.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
