THREAT WATCH · September 29, 2026 · RANSOMWARE LISTING

Advantech Listed on CHAOS Ransomware Tracker

Advantech, a manufacturing and engineering company based in Taiwan, Province of China, appears on a ransomware tracker operated by the group known as CHAOS. The listing was recorded on September 29, 2026. The company has not publicly disclosed a breach or acknowledged the claim. The organization employs more than 1,000 people and operates in a sector that routinely handles sensitive design data and proprietary processes.

Key takeaways

• Advantech appears on the CHAOS ransomware tracker as of September 29, 2026.
• The company has not disclosed a breach or acknowledged the listing.
• CHAOS is a ransomware group that publishes victim names on a leak site.
• Manufacturing and engineering firms hold sensitive IP that raises the stakes if data was exfiltrated.

What we know

• Advantech (advantech.com) is listed on the CHAOS ransomware tracker.
• The listing date is September 29, 2026.
• The company operates in the manufacturing and engineering sector.
• It employs more than 1,000 people.
• The disclosure status is not disclosed yet.

About the listing

A ransomware listing means the organization's name and domain appear on a tracker maintained by the attacking group. It is a strong signal that the group claims to have obtained data from the target. It is not a confirmed breach. The company has not publicly acknowledged or denied the claim as of the time of this post. Until the organization speaks or the group publishes evidence, the true status of the incident remains unclear.

About CHAOS

CHAOS is a ransomware group that maintains a public leak site where it lists victims. Groups like CHAOS typically publish stolen data if the targeted organization does not pay a ransom. The presence of a listing does not confirm that data was exfiltrated, only that the group claims to have done so. These groups often target large organizations because they are more likely to have valuable data and the resources to pay. CHAOS has been active in targeting manufacturing and industrial firms, which aligns with the sector profile of this listing.

What this means for Advantech

Advantech is a large organization with more than 1,000 employees. If the claim is accurate, the potential impact could be significant given the company's size and sector. Manufacturing and engineering firms often hold sensitive intellectual property, design files, operational data, and supplier information. A breach of that data could affect not only the company but also its partners and customers across the supply chain. The lack of disclosure means the situation remains unresolved and the full scope is unknown.

What to watch

• Whether Advantech issues a public statement acknowledging or denying the listing.
• Whether the CHAOS group publishes any data related to the company on its leak site.
• Whether other organizations in the manufacturing and engineering sector appear on the same tracker in the coming days, which could indicate a broader campaign.
• Whether the listing is removed, which sometimes happens when a group decides not to follow through on a claim.

Bottom line

The listing is a credible early warning signal. It does not prove a breach occurred, but it warrants attention from security teams and business leaders. Organizations with relationships to Advantech should monitor for any follow-up disclosures and review their own exposure through shared supply chains or data flows.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.