MathWorks

Summary

MathWorks experienced a ransomware attack that disrupted its IT systems and caused multiple customer‑facing services to go offline. The affected applications included MATLAB Answers, Cloud Center, File Exchange, MATLAB Grader, Cody, Downloads, ThingSpeak, MATLAB Online, MATLAB Mobile and the account portal, with some services later restored while others remained degraded or unavailable. The company notified federal law enforcement and is working with cybersecurity experts to restore the remaining systems and investigate the incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On May 18, 2025, MathWorks began investigating an issue affecting multiple applications after users reported disruptions, and the status page indicated that the company was assessing impact and determining the cause. Throughout the day and the following days, updates repeatedly stated that the investigation was ongoing, with no immediate resolution reported. On May 26, 2025, MathWorks disclosed that a ransomware attack had occurred, affecting its IT systems and causing certain online applications used by customers and internal systems used by staff to become unavailable beginning on Sunday, May 18. The company noted that it had notified federal law enforcement about the incident and was working with cybersecurity experts to restore services. Initial updates indicated that many systems had been brought back online while others remained offline, and that the investigation into the attack’s scope and origin continued.

Restoration efforts progressed over the subsequent days, with MATLAB Online and MATLAB Mobile reported as restored on May 23, and ThingSpeak restored for existing users on May 24. MATLAB Answers and Cloud Center were restored for existing users on May 27, although File Exchange remained in a degraded state with file viewing and GitHub sync not yet enabled. MATLAB Grader and Cody were also restored for existing users on May 27, while the Downloads service continued to be in an outage state. The MathWorks Account service experienced degradation that prevented users from creating new accounts and caused sign‑in difficulties for those who had not signed in since October 11, 2024, with two‑step verification working intermittently; updates on May 21 indicated that Single Sign‑On and multi‑factor authentication were functioning again, which should alleviate many sign‑on issues. Throughout the period from May 18 to May 27, the status page consistently communicated that the company was continuing to investigate the ransomware incident, bringing systems back online as they became available, and would provide further updates as the situation evolved.

Sources

Sources available to members: 1 source.