Analog Devices says files were taken out of its systems on 23 June, and told the SEC about it on Wednesday evening under Other Events
The intrusion was identified on 23 June. Analog Devices disclosed it on the evening of 29 July, thirty six days later, in a filing that runs to a page and a half.
The chipmaker told the Securities and Exchange Commission that it identified unauthorised access to certain company systems on that June date, activated its incident response protocols, engaged external cybersecurity experts and notified law enforcement. Operations were never interrupted, the filing says. Then comes the finding that gives the document its weight: the investigation "has found that certain files were exfiltrated from the affected systems", and the work of establishing what was in them "remains ongoing".
So the company knows data left and does not yet know what data. It says that to its knowledge the information has not been publicly released or used for fraudulent purposes, that it will keep monitoring for misuse, and that it will notify affected parties and applicable regulators as appropriate and in accordance with applicable law.
The item number is part of the disclosure
The submission header carries one item, and it is Item 8.01, Other Events. The filing states that based on information currently known, and on the containment and mitigation measures taken, Analog Devices does not believe the 23 June incident is reasonably likely to materially impact its business, operations or financial condition. That sentence and the item number are the same statement made twice, once in prose and once in the header.
Nothing in the document explains the gap between 23 June and 29 July, and this brief does not supply a reason for it.
A second matter, unnamed
The last paragraph of Item 8.01 is four lines long and reports something else. On 26 July the company "was made aware of public reports regarding a disparate cybersecurity matter", which it calls separate and unrelated, and it says it is assessing that matter's validity, scope and any potential impact.
The filing does not say what those reports are, and this brief does not name them either. The accounts in circulation rest on a criminal leak site listing repeated by security vendor blogs, none of it carrying a named byline at an established outlet, which puts it below the sourcing floor this publication works to. Analog Devices itself says it has not yet established whether the matter is valid. Both of those are reasons to wait.
What can be said is that the company chose to put the second matter in the same filing as the first, and to say in terms that it does not connect them.
