Trio-Tech Singapore Ransomware: Files Encrypted, Data Disclosed

March 20, 2026: Trio-Tech International, a semiconductor testing company, told the SEC that ransomware had encrypted files on its Singapore subsidiary’s network and that certain company data was disclosed without authorisation. Canonical record: trio-tech-singapore-ransomware2026. Coverage that links to the filing: The Record.

This incident is older than most of the posts on this site, but it was only recorded in our catalog this week. It matters because the company’s own filing shows how an attack that was first judged minor can change in a matter of days. The record is company-confirmed; the data types are not.

What happened

• March 11, 2026: The company discovered the intrusion. Files on the Singapore subsidiary’s network were encrypted.
• Initial assessment: Management first determined the incident was not material.
• March 18, 2026: The incident escalated and resulted in the unauthorised disclosure of certain company data.
• March 20, 2026: The company filed with the SEC. It said management had concluded the incident may constitute a material cybersecurity event.
• Response: The company took its network offline, hired cybersecurity experts, and notified law enforcement in Singapore. It was still restoring systems when it filed.

What is known about the data

The filing says certain company data was disclosed without authorisation. It does not list the data types, and the company says it is notifying affected parties. Anyone who worked with the subsidiary, or whose information was held on its network, should expect to receive direct notice if their data was involved.

Why the reassessment matters

The filing’s own history is the useful part for readers. On March 11 the company judged the incident not material. A week later, after the attack escalated into an unauthorised disclosure, management concluded the incident may be material. Companies make early calls like that under pressure, and the revision shows a first assessment can be wrong. For anyone relying on the company’s early statements, the lesson is to read the later filing as well as the first one.

How to keep track of updates

Public companies disclose follow-up through later SEC filings. In the sources reviewed for this post, no later update was found, so check the company’s filing history on the SEC’s EDGAR database for amendments. A notice to affected parties may arrive before any public filing names the data involved, so a letter from the company is the most direct source for an individual.

Verified vs unverified

• Verified (company SEC filing, as reported): the March 11 discovery; the encryption of files in the subsidiary’s network; the March 18 escalation with unauthorised disclosure of certain company data; the reassessment of materiality; the notification of Singapore law enforcement; the notification of affected parties.
• Not disclosed: the entry point, the data types, and the number of people affected.
• Press reporting only: one outlet reports that stolen data was published online. Other coverage did not confirm this, so treat it as unverified.

Who is at risk

The people most exposed are employees, customers and partners whose information sat on the Singapore subsidiary’s systems. Business contacts are also at risk of payment-change fraud if an attacker has access to correspondence about invoices.

Subsidiaries are a common route into wider company data, because they often hold their own contracts, staff records and customer files. Readers who deal with the Singapore operations should assume that past correspondence with the subsidiary could have been read by someone outside the company.

What to do

1. If you worked with Trio-Tech’s Singapore operations, watch for a direct notice and verify it before acting on it.
2. Verify payment changes by phone on a number you already had, not one supplied in an email. This is the most common follow-on fraud after a company breach.
3. Check the company’s SEC filings for updates. The filing says the company will continue to assess the incident.
4. Be cautious with unexpected messages that mention the incident, especially ones asking you to click a link or sign in to a system.
5. If you are a supplier, ask for written confirmation of any new bank details before the next payment, and check it on a number you already hold.

Context

Ransomware that encrypts files and then discloses data is a two-stage problem. Restoring systems does not undo the disclosure, so the notification phase can go on for months. The filing’s own wording, “may constitute a material cybersecurity event,” is a useful reminder that early assessments can be revised.

What this record does not establish: it does not say which data was taken, whether anyone outside the company holds it, or how many people are affected. Those questions depend on the company’s notices to affected parties, which the filing says are under way. Until they appear, the record stays company-confirmed and scope-unknown.

Sources

• The Record: California-based semiconductor testing company reports ransomware attack to SEC
• The Register: Chip tester shrugged off ransomware

Related reading

• Moldova’s CNAM health-insurance cyberattack: another case where an early public assessment was overtaken by a wider disclosure.