Data I/O Corporation
Data I/O ransomware disrupted manufacturing and shipping
Summary
Ransomware disrupted Data I/O’s manufacturing, shipping, receiving and communications after an Aug. 16, 2025 incident. The company reported full global system restoration by Sept. 4 and later disclosed about $388,000 in remediation and professional fees.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted location
Organization types
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Vulnerability exploitation
Exploitation of a software or hardware vulnerability to gain unauthorized access or execute malicious actions.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Manufacturing or production disruption
Manufacturing, production, assembly, processing, or industrial operations were reduced, stopped, or impaired.
-
Supply chain disruption
Procurement, inventory, warehousing, shipping, delivery, vendor, or other supply-chain processes were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Data I/O confirmed a ransomware incident on Aug. 16, 2025, that disrupted manufacturing and logistics functions while the company took systems offline. A Sept. 4 company announcement established that all global systems had been restored; it attributed entry to a vulnerability involving an unnamed commercial firewall service provider.
In its initial public filing on Aug. 21, the company identified affected manufacturing, shipping, receiving, communications and support functions. Its initial view that business operations had not suffered a material impact was a financial-materiality assessment, not a denial of those specific disruptions. We reported the disclosure on Aug. 22.
Operational significance
Data I/O makes equipment that programs and provisions semiconductor devices. The incident affected the company’s own production and fulfillment operations. Public evidence does not establish that customers’ factories stopped operating or that the attack compromised chips, programming products or customer devices.
The company brought in external specialists and restored functions in stages. Its Sept. 4 update said global systems were back and order flow remained on track. Management believed no revenue had been lost.
Costs changed as the investigation progressed. A later filing increased the initial $180,000 projected third-quarter expense to approximately $388,000 as of Sept. 9. The 2025 annual report, filed April 16, 2026, subsequently reported approximately $388,000 in one-time remediation and professional fees. These costs are distinct from lost revenue and ransom payment.
Confidence and uncertainty
Confidence is high in ransomware and disruption because the company explicitly disclosed both. The recovery filing attributes the intrusion to an unnamed firewall-provider vulnerability; it does not identify the provider, product or CVE, or establish that the provider’s own environment was compromised.
Attribution remains unresolved. No reviewed victim statement identifies a group, and name/domain claim searches produced no matching lead. Speculation based on the company’s customers or industry does not identify the attacker. The reviewed evidence does not establish a ransom amount, payment, confirmed data theft or affected personal-information population.
Analytic gaps
The intrusion’s initial access date, specific vulnerability, attacker identity, data scope, encryption details and exact technical restoration day remain undisclosed. Aug. 16 is the company’s reported incident date, not an inferred earlier access date. The restoration announcement establishes recovery by Sept. 4 without specifying when the last affected function returned.
The annual report discusses continuing financial-reporting control weaknesses and further technology improvements. Those matters do not establish a continuing ransomware outage after the company’s affirmative restoration statements.
Operations are resolved based on the company’s positive report of full restoration, reinforced by later filings. The last contemporaneous observation of ongoing disruption is the Aug. 21 initial filing. The company identified Aug. 16 as the incident date but did not establish the exact technical completion day.
Organizations involved
Impacted location
Redmond, Washington
Redmond is the affected company’s headquarters and primary engineering and operational site anchor. The company described a global systems response; this site does not establish that all effects were physically confined to Redmond or that municipal services were affected.
Sources
Our report covered ransomware affecting manufacturing, shipping, receiving and communications at Data I/O.
Data I/O reported an Aug. 16 ransomware incident and ongoing effects on manufacturing, shipping, receiving, communications and support systems.
The company said all global systems were restored and order flow was on track, and identified an unnamed commercial firewall-provider vulnerability.
The company reiterated complete containment and restored operations and revised expected third-quarter incident costs to about $388,000 as of Sept. 9.
The annual filing confirms global restoration by September 2025 and approximately $388,000 in one-time remediation and professional fees.
County descriptions identify rural Sammamish and Snoqualmie valleys, Cascade forests, agricultural districts, Vashon-Maury Island and unincorporated urban areas.
Data I/O designs and manufactures semiconductor-programming and security-provisioning systems; its headquarters, engineering and manufacturing operations are in Redmond.
The city describes its Sammamish Valley setting, Indigenous history, logging and agricultural development, 1912 incorporation and later technology-sector growth.
See something that needs correction?
Signed-in members can report an error, update, or missing source.