Loading story…
Foxconn confirmed that a cyberattack affected several of its North American factories, disrupting operations and forcing some facilities to fall back to manual processes while incident response teams worked to restore systems. Reporting tied to a Wisconsin site said the intrusion caused Wi-Fi and network outages, impaired computer operations, and led employees to use paper-based workflows before some were sent home. Foxconn said it activated cybersecurity response and business continuity measures immediately and that impacted plants are resuming normal production and delivery operations.
The Nitrogen ransomware group claimed responsibility, alleging it stole 8 TB of data and more than 11 million documents, including confidential material related to major technology customers such as Apple, Intel, Google, Nvidia, and AMD. Security researchers have described Nitrogen as a financially motivated group first seen in 2023, with ransomware built from leaked Conti 2 code and earlier links to malware used to deploy BlackCat/ALPHV. The incident adds to a string of ransomware attacks previously disclosed by Foxconn, including cases tied to LockBit and DoppelPaymer.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Foxconn publicly disclosed that some of its North American factories were impacted by a cyberattack. The confirmation came as reporting linked the incident to Nitrogen's extortion claims and Foxconn stated operations were being restored.
The Nitrogen ransomware gang publicly claimed responsibility for the Foxconn incident, alleging it stole about 8 TB of data and more than 11 million documents. The gang said the stolen material included confidential information tied to customers such as Apple, Intel, Google, Nvidia, and AMD.
Following the attack, Foxconn said it immediately activated its cybersecurity response mechanisms and implemented measures to maintain production and delivery continuity. The company reported that affected facilities were working to resume or had begun resuming normal operations.
Foxconn said several of its North American factories were affected by a cyberattack. At a Wisconsin facility, the incident reportedly caused Wi-Fi and network outages, disrupted computer operations, and forced staff to switch to paper-based processes before some employees were sent home.
Barracuda Networks and other researchers first observed the financially motivated Nitrogen threat group in 2023. The group was initially associated with malware delivery activity and later linked to ransomware derived from leaked Conti code.
Foxconn said an information system supporting some Americas operations was attacked on 2020-11-29, affecting Foxconn CTBG MX / North America operations tied to Ciudad Juárez, Mexico. DoppelPaymer claimed it stole files before encrypting systems, demanded about $34.7 million in bitcoin, and Foxconn said it was restoring systems in phases while working with technical experts and law enforcement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecyberscoop.com
Open sourcesecurityaffairs.com
Open sourcetechrepublic.com
Open sourcecybersecuritynews.com
Open sourcetechcrunch.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Foxconn said operational IT issues disrupted its Mount Pleasant, Wisconsin campus, where workers reported a broad network outage affecting Wi‑Fi, core infrastructure, and timekeeping systems as production was gradually restored. The **Nitrogen** ransomware group later claimed responsibility on its extortion site, alleging it stole **8TB** of data spanning more than **11 million files** from the Racine County facility, including assembly instructions, hardware schematics, and data center topology diagrams tied to customers such as **Apple, Intel, Google, NVIDIA, and Dell**. Foxconn has not verified the authenticity of the leaked samples or disclosed any ransom demand, and reports said the incident may also have affected a Foxconn site in Houston. The claimed breach adds to a pattern of ransomware incidents affecting Foxconn manufacturing operations. In 2022, Foxconn confirmed a ransomware attack at its **Tijuana, Mexico** plant that disrupted production and was claimed by **LockBit**, with the company saying recovery was underway and overall business impact would be limited. That attack followed a 2020 intrusion at Foxconn’s **Ciudad Juárez** facility attributed to **DoppelPaymer**, underscoring repeated targeting of the company’s production sites and raising renewed supply-chain and industrial espionage concerns around its AI server and electronics manufacturing operations.
Jun 29, 2026
Foxsemicon Integrated Technology Inc. (FITI), a Taiwanese semiconductor parts manufacturer affiliated with Hon Hai Technology Group, said it was hit by a ransomware attack that defaced its website and displayed a threat to leak allegedly stolen data. The attackers, identified in reporting as the **LockBit** ransomware gang, claimed they had stolen and encrypted **5TB** of company data, including customer and employee personal information, and warned they would publish it on a darknet leak site if a ransom was not paid. Foxsemicon told the Taiwan Stock Exchange it restored its website the same day it detected the incident, brought in security experts, and did not expect a significant impact on operations. The company did not disclose any ransom demand and had not confirmed whether customer or employee data was actually exfiltrated, while parts of its website reportedly remained inaccessible and search results continued to show the attackers' message. The incident stood out because website defacement is considered unusual for LockBit, which more commonly pressures victims through its extortion portal.
Jun 29, 2026
Nidec Corporation disclosed that its Taiwanese subsidiary, **Nidec Chaun Choung Technology Corporation**, was hit by a ransomware attack that compromised and damaged servers, forcing the shutdown of affected systems and networks. The company said the incident was confirmed on 22 June and that investigators are assessing the impact on production, shipping, business operations, and whether personal or confidential information was exposed. Nidec added that the subsidiary operates on an independent network and said the attack did not affect Nidec Corporation or other Nidec Group companies. A previously unknown ransomware group calling itself **BlackField** claimed responsibility and said it stole **2TB** of data from the subsidiary’s IT environment. The group demanded **$2 million** to delete the data, offered a **$5,000-per-day** delay before publication, and advertised the full dataset for sale for **$400,000**, indicating a double-extortion operation. BlackField also reportedly posted sample file structures and documents as proof of theft, although the authenticity of those materials had not been independently verified.
Jul 7, 2026