MathWorks affected by ransomware attack

📟 News

Date: 28/05/2025

MathWorks, Inc., an American corporation specializing in mathematical computing software, was affected by a ransomware attack resulting in service interruptions.

Founded in 1984, MathWorks is headquartered in Massachusetts and has more than 34 offices worldwide with more than 6,500 employees. MathWorks develops the MATLAB platform and the Simulink graphical simulation environment that are used by more than 100,000 organizations and 5 million customers.

“MathWorks experienced a ransomware attack. We have notified federal law enforcement of this matter. The attack affected our IT systems. Some of our online applications used by customers became unavailable, and certain internal systems used by staff became unavailable, beginning on Sunday, May 18,” — MathWorks.

Service interruptions caused by the attack still continue (e.g. the cloud center, file sharing, license center, and MathWorks store might be out of service), but the company has already restored some services and addressed third-party cybersecurity experts for assistance.

For several days, users were unable to access their accounts due to problems with signatures, but on May 21, MathWorks restored multifactor authentication and SSO (Single Sign On).

However, some customers are still experiencing problems preventing them from creating new accounts. Additionally, those who haven’t logged in since October 11, 2024, are unable to log in at all.

So far, MathWorks hasn’t released any additional information about the incident. The extortionists behind this attack are unknown; the question whether customer data were compromised remains open. No hacker group has claimed responsibility for the attack yet.

Related posts:
2025.02.09 — Abandoned AWS S3 buckets could be used in attacks targeting supply chains

watchTowr discovered plenty of abandoned Amazon S3 buckets that could be used by attackers to deliver malware and backdoors to government agencies and large corporations. The researchers discovered…

Full article →
2025.04.12 — Hackers compromised a bureau within the U.S. Department of the Treasury and spent months in hacked systems

The Office of the Comptroller of the Currency (OCC), an independent bureau within the United States Department of the Treasury, reported a major cybersecurity incident. Unknown attackers had…

Full article →
2025.02.10 — Failed attempt to block phishing link results in massive Cloudflare outage

According to the incident report released by Cloudflare, an attempt to block a phishing URL on the R2 platform accidentally caused a massive outage; as a result, many Cloudflare…

Full article →
2025.04.01 — Hackers abuse MU plugins to inject malicious payloads to WordPress

According to Sucuri, hackers store malicious code in the MU-plugins (Must-Use Plugins) directory in WordPress and execute it while remaining undetected. The technique was first discovered…

Full article →
2025.02.05 — Google patches Android zero-day vulnerability exploited by hackers

Google released the February set of patches for Android. In total, they fix 48 bugs, including a kernel zero-day vulnerability actively exploited by hackers. The zero-day's…

Full article →
2025.01.22 — Fake Homebrew Infects macOS and Linux Machines with infostealer

Attackers use Google ads to disguise themselves as the Homebrew website and distribute malware targeting Mac and Linux systems and stealing logon credentials, browser data, and cryptocurrency wallets.…

Full article →
2025.04.16 — Android devices will restart every three days to protect user data

Google introduces a new security feature for Android devices: locked and unused devices will be automatically restarted after three days of inactivity to return their memory to an…

Full article →
2025.01.30 — Hackers use vulnerabilities in SimpleHelp RMM to attack corporate networks

Experts believe that recently patched vulnerabilities in SimpleHelp Remote Monitoring and Management (RMM) were used by attackers to gain initial access to corporate networks. A number…

Full article →
2025.02.06 — Let's Encrypt to stop sending expiration notification emails

The nonprofit organization announced that, starting June 4, 2025, it will stop sending expiration notification emails to subscribers. The primary reason behind this decision…

Full article →
2025.02.14 — 12,000 Kerio Control firewalls remain vulnerable to RCE

Security experts report that more than 12,000 GFI Kerio Control firewall instances remain vulnerable to the critical RCE vulnerability CVE-2024-52875, which was fixed…

Full article →