MathWorks
MathWorks ransomware attack disrupts software services
Summary
MathWorks’ 2025 ransomware attack disrupted online applications, licensing and downloads from May 18 through June 5. Unauthorized access began around April 17, and later notifications involved personal information. U.S. university customers documented service effects.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing. -
Incident end:
?
Confirmed or defensibly assessed end of material operational disruption or incident activity.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Data exposure
Data was made accessible to unauthorized parties through misconfiguration, system compromise, improper access controls, or another unintended condition.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Complete service outage
A primary service, system, platform, or operational capability became entirely unavailable.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Cloud service disruption
Cloud-hosted infrastructure, software, storage, identity, or platform services were unavailable or materially impaired.
-
Authentication disruption
Users were unable to authenticate, sign in, access accounts, or use identity-dependent services.
-
Transaction processing disruption
Business, financial, customer, administrative, or operational transactions could not be completed normally.
-
Educational operations disrupted
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
-
Third-party service disruption
The incident materially affected services delivered by or through a vendor, managed service provider, contractor, partner, or other third party.
-
Downstream organization impact
The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
MathWorks’ May 2025 ransomware attack interrupted customer applications and internal systems used by staff. The Natick, Massachusetts, software developer’s original status timeline documented disruption beginning May 18 and explicitly identified ransomware in a May 26 update. We assess the cyberattack with high confidence because the company confirmed it and documented the resulting service failures.
The compromise preceded the outage. In a notification letter dated Aug. 22, MathWorks said unauthorized access to its internal network appeared to have occurred approximately April 17–May 18. The earlier access period and the May 18 onset of service disruption describe different stages of the same incident.
Operational significance
The outage affected downloads, licensing, account access and online tools used with MATLAB and Simulink. Authentication, MATLAB Online and MATLAB Mobile returned before other functions. Downloads and basic licensing were restored May 28, while purchasing, administration and reporting remained limited. License Center reports were still unavailable June 3. The company closed the incident June 5 at 5:28 p.m. Eastern after restoring License Center.
University notices document downstream effects. North Carolina State University warned that users could not download new versions or additional toolboxes and offered a workaround for a launch error. Its June 2 update described restored downloads. Western Washington University reported unavailable MathWorks products May 20 and local restoration May 27. Western expressly distinguished the vendor outage from unrelated campus service problems. These notices establish affected customers, without establishing intrusions at either university.
Confidence and uncertainty
Ransomware is confirmed by MathWorks; the group and malware family remain unidentified. In its investigation statement, the company described a financially motivated commodity attack, FBI notification and completed containment. It said the last observed threat activity was May 18 and that its findings did not warrant customers blocking software installations or interactions with its domain.
Personal information potentially involved varied by person and included names, addresses, birth dates and Social Security or other national identification numbers. The company’s notification letter said it had no indication of publication, sale or additional misuse at that time. BleepingComputer reported 10,476 affected people, citing a Maine filing, and described stolen records. That count is attributed to the reporting; the separately reviewed company letter does not supply it.
Analytic gaps
The reviewed record does not establish the initial entry method, a ransom demand or payment, or the full extent of customer losses. Different customer recovery dates do not establish complete vendor restoration before June 5. No verified evidence supports attributing the attack to a named group or inferring payment from the absence of a public claim.
Organizations involved
North Carolina State University
Location
Organization type
Critical infrastructure
Western Washington University
Location
Organization type
Critical infrastructure
Impacted locations
Natick, Massachusetts
Natick is the headquarters location of the affected software company. Reported system disruption affected the company and its online services; it does not establish a municipal outage.
Raleigh, North Carolina
Raleigh anchors the affected university customer. Its notice documents impaired access to vendor software; no campus intrusion is established.
Bellingham, Washington
Bellingham anchors the affected university customer. Its notice concerns MathWorks infrastructure and distinguishes unrelated campus service problems.
Sources
We reported that MathWorks’ ransomware incident disrupted online applications and internal systems, with licensing and downloads among the affected services.
The initial May 18 outage notice was followed by explicit ransomware acknowledgment May 26. Recovery proceeded by application and function; the incident closed June 5 at 5:28 p.m. Eastern after License Center returned.
Western reported a MathWorks infrastructure outage May 20 and local restoration May 27, expressly distinguishing it from unrelated campus service problems.
The university warned that the incident prevented downloads of new MATLAB versions and additional toolboxes. It suggested opening a MATLAB file rather than the application for a particular error; a June 2 update described restored download availability.
BleepingComputer reported that the Maine filing identified 10,476 affected people and described data theft. The company’s separately read Massachusetts notice confirms unauthorized access and personal-information involvement without supplying that count.
MathWorks confirms a financially motivated commodity ransomware attack, FBI notification, containment and a completed forensic investigation. It says no threat activity requires customers to block software installations or interactions with its domain.
The company says unauthorized internal-network access appears to have occurred around April 17–May 18. Personal information varied by person. It reported no indication of personal data being sold, published or misused at the time of the notice.
See something that needs correction?
Signed-in members can report an error, update, or missing source.