Data Breach Notifications

Entity Information

  • Type of Organization: Other Commercial
  • Entity Name: MKS Instruments, Inc. (“MKSI")
  • Street Address: 2 Tech Drive, Suite 201
  • City: Andover
  • State, or Country if outside the US: Massachusetts
  • Zip Code: 01810

Submitted By

  • Name: Jonathan Tam
  • Title: Law firm partner
  • Firm name (if different than entity): Baker & McKenzie LLP
  • Telephone Number: 415-984-3883
  • Email Address: Jonathan.Tam@bakermckenzie.com
  • Relationship to entity whose information was compromised: Outside counsel

Breach Information

  • Total number of persons affected (including residents): 8 Maine residents have been affected.
  • Total number of Maine residents affected: 8
  • If the number of Maine residents exceeds 1,000, have the consumer reporting agencies been notified:
  • Date(s) Breach Occured: We do not know the exact date that the breach occurred but it likely happened on or in the period immediately preceding February 3, 2023.
  • Date Breach Discovered: On February 13, 2023 at 9.20 am Pacific Standard Time, MKSI became aware that a ransomware event on its systems that was focused on encrypting its business and manufacturing systems and making them unavailable to it may have also involved exfiltration of personal data. On February 3, 2023, MKSI identified that it had become subject to a ransomware event and took immediate action to activate its incident response and business continuity protocols to contain the incident. MKSI initiated an ongoing investigation, alongside outside experts, and reported the issue to U.S. law enforcement. MKSI issued a public statement regarding the incident shortly after it was discovered, and has been in contact with personnel, customers, suppliers and other stakeholders about how MKSI is responding to the incident. The incident affected certain business systems, including production-related systems, and as part of the containment effort, MKSI elected to temporarily suspend certain operations. MKSI has been restoring various systems as soon as it determined that it was safe to do so, and will continue to do so as quickly and securely as possible until MKSI has returned its systems to normal operations.
  • Description of the Breach:
    • External system breach (hacking)
  • Information Acquired - Name or other personal identifier in combination with: Social Security Number

Notification and Protection Services

  • Type of Notification: Written
  • Date(s) of consumer notification: 02/16/2023
  • Copy of notice to affected Maine residents: MKS Instruments, Inc. - Template Notification to Affected Data Subjects.pdf
  • Date of any previous (within 12 months) breach notifications: N/A
  • Were identity theft protection services offered: Yes
  • If yes, please provide the duration, the provider of the service and a brief description of the service: To help relieve concerns and restore confidence following this incident, we will provide identity monitoring services provided by Equifax at no cost to affected consumers for 2 years. Affected consumers will be sent details by mail as to how to activate their identity monitoring services and additional details regarding the services to be provided. Consumers have up to 120 days to request and activate the monitoring services.