German A., a 43-year-old Russian engineer, is accused of secretly supplying sensitive technical information from ASML, NXP, and TSMC to Russia, allegedly to assist in building a 28nm-capable fab there, reports NRC. His illicit earnings were about €40,000, and he now faces 18 to 32 months in prison. Though German A. alone could not steal full designs for a semiconductor, a coordinated group could potentially assist semiconductor production in Russia.
Hundreds of confidential documents stolen
German A. is accused of supplying Russia with confidential technical materials from ASML, GlobalFoundries, NXP, TSMC, and GlobalFoundries, including semiconductor production manuals and various chipmaking machines. The investigators reportedly found that he obtained 105 internal documents from ASML and 88 files related to TSMC.
The materials did not contain complete blueprints for building wafer fabrication equipment or something more significant (e.g., a fab itself or how to design a process technology). Still, they were labeled confidential and could support the setup of a basic semiconductor line capable of producing chips at 28nm-class process technology, which is good enough for military applications. Investigators believe he shared this data via cloud storage and messaging apps and handed over a USB stick in Moscow, allegedly earning around €40,000 in the process.
German A. is reportedly also linked to an attempt to acquire a chemical vapor deposition tool, possibly as part of efforts to equip a future chip facility in Russia. However, according to the report, the tool was first redirected to Israel and then never delivered.
In August 2024, German A. was taken into custody following a report from the national intelligence agency. A month later, ASML and NXP were officially informed of the espionage suspicion. His case is now being handled in court, and authorities suspect ties to Russian intelligence. Both firms are involved in the investigation and have filed complaints against the former employee.
While German A. could not possibly steal blueprints of all tools necessary to build a fully functioning semiconductor production facility in Russia, a network of such spies could potentially do the job and revive semiconductor production in the hostile nation.
A long career
Before his arrest in 2024, German A had a long career in the semiconductor development and production industry. In 2008 and 2009, he interned at Imec, a research center in Belgium. After that, he joined the Greek research institute NCSR and later started to work at Fab 1, a Dresden facility of GlobalFoundries.
Get Tom’s Hardware’s best news and in-depth reviews, straight to your inbox.
In 2015, he joined a Dutch start-up called Mapper, which developed a maskless lithography technology based on massively parallel e-beam writing using 10,000 – 13,000 e-beams. Mapper received financial backing from Rusnano, a state-controller high-tech investor, in 2012 and built a small site in Russia to manufacture MEMS (micro-electromechanical systems).
When Mapper went bankrupt in late 2018, ASML absorbed its assets and personnel under pressure from the Dutch and U.S. governments to protect the technology. German A. was among over 100 engineers who moved to ASML, where he operated machines for producing electro-optical components. For now, ASML’s employees describe German A. as a ‘not high flyer,’ whereas others claim he was a committed but introverted technician who had difficulty communicating. However, according to NRC, German A.’s name appears on four patent filings associated with ASML, the latest of which was published just a month ago. These documents list several inventors, and it is unclear whether German A. played a significant role in those innovations.
A review of his digital activity shows that he accessed restricted files on two days in December 2020, even though he had no need for them. At the time, the company’s internal security systems did not raise any alerts. Experts asked by NRC believe the leaked data includes presentations and manuals but not the core plans needed to construct chip machines or an entire plant. His contract ended in 2021 when ASML outsourced his work.
After ASML, German A. used recruitment agencies to look for work in research roles but was unsuccessful. In January 2022, during the pandemic, he joined NXP in Nijmegen on a temporary contract as a process technician. In May of that year, he contacted a company in Nijmegen to request a quote for a used chemical vapor deposition tool from ASM International. Initially, the equipment was supposed to be shipped to Germany, but he later changed the destination to Israel. The item was never delivered. This is now seen as an attempt to gather parts for a new facility.
Statements from his former spouse reveal that by late 2023, he was in touch with Russian researchers about building a fab in Russia capable of producing chips using a 28nm technology. Back then, Russian entities were blacklisted and could not get advanced chips from prominent suppliers, whether distributors or foundries.
That same year, he held a one-year position at TU Delft but remained isolated, and investigators found no signs of theft there.
Not first time
Both ASML and NXP experienced breaches involving unauthorized access in the past. In late 2023, it was revealed that a cyber group linked to China had been covertly operating within NXP’s systems for an extended period. ASML also battles frequent cyberattacks and insider threats: in early 2022, a former Chinese employee stole confidential data. Although that employee, just like German A., lacked access to complete designs needed to construct a fab tool or equip a fab, a broader network of similar operatives could realistically piece together enough to boost the semiconductor industries of China and Russia.
In response, both companies have strengthened their digital defenses: internal systems now limit access between departments and employee activity is tracked for unusual behavior.
