A Russian Engineer's Covert Operation

At the end of 2024, a shocking espionage case surfaced: a Russian engineer working at ASML had been caught stealing confidential data. Now, new reports from Dutch media provide a detailed breakdown of how he carried out the operation.

According to NRC, 43-year-old German A. was accused of secretly supplying sensitive semiconductor data from ASML, NXP, and TSMC to Russia. His objective? To help establish a 28nm-capable chip fabrication plant in Russia—a significant move for a country struggling under technology sanctions. German A. allegedly earned about €40,000 from these illegal activities and now faces 18 to 32 months in prison.

Investigators found that he had stolen at least 105 internal ASML documents and 88 files related to TSMC, including semiconductor production manuals and chipmaking machine blueprints. While these files did not contain complete designs for fabricating chips or building manufacturing tools, they could still help set up a basic semiconductor production line. Experts warn that while one person alone may not achieve much, a coordinated espionage network could significantly aid Russia's semiconductor ambitions.

How the Espionage Worked

Authorities believe German A. transferred stolen data via cloud storage and messaging apps and handed over a USB drive in Moscow as part of the operation. He was also linked to an attempt to acquire a chemical vapor deposition (CVD) tool, which was first directed to Israel but never delivered—possibly an effort to equip a future Russian chip factory.

His activities caught the attention of Dutch intelligence, leading to his arrest in August 2024. A month later, ASML and NXP were officially informed of the security breach. Both companies have since filed complaints against him, as Dutch authorities continue investigating his potential ties to Russian intelligence agencies.

A Long Career in the Semiconductor Industry

Before his arrest, German A. had a lengthy career in semiconductor development. His past roles included:

 ● 2008-2009: Internship at imec, a Belgian research center.

 ● 2010s: Work at GlobalFoundries in Dresden.

 ● 2015: Joined Dutch start-up Mapper, which specialized in maskless e-beam lithography—a technology that later attracted investment from Russian state-controlled tech fund Rusnano. Mapper also set up a small MEMS (micro-electromechanical systems) facility in Russia.

 ● 2018: ASML acquired Mapper's assets after its bankruptcy. German A. became one of 100+ engineers who transitioned to ASML.

During his time at ASML, he worked on electro-optical component production. While colleagues described him as an introverted and unremarkable employee, his name appeared in at least four ASML patent filings, with the latest published just a month before his arrest.

However, security logs from December 2020 show that he accessed restricted ASML files without authorization. At the time, ASML's security systems failed to detect any red flags. His contract ended in 2021 when ASML outsourced his department's work.

After leaving ASML, German A. struggled to find permanent research roles. He briefly worked at NXP in 2022, then attempted to source a second-hand CVD machine—which investigators now believe was part of his effort to gather parts for a new Russian chip facility.

By late 2023, he was reportedly in direct contact with Russian researchers about constructing a 28nm chip fabrication plant in Russia. Since Russian companies were blacklisted from purchasing advanced chips, they sought alternative ways to acquire semiconductor technology.

Espionage Threats in the Semiconductor Industry

This case is not the first time ASML and NXP have faced espionage.

 ● In 2023, reports revealed that a China-linked cyber group had been secretly operating inside NXP's systems.

 ● In 2022, a former ASML employee from China stole confidential chipmaking data.

While these individual spies may not have accessed complete designs for chip fabrication tools, experts warn that a coordinated effort could significantly aid China's and Russia's semiconductor industries.

Strengthening Security Measures

In response to growing security risks, ASML and NXP have reinforced their cybersecurity measures:

 ● Stricter access controls between departments.

 ● Enhanced monitoring of employee activity for suspicious behavior.

As the global semiconductor race intensifies, leading firms are now facing not only economic competition but also national security threats.