Loading story…
Nidec Corporation disclosed that its Taiwanese subsidiary, Nidec Chaun Choung Technology Corporation, was hit by a ransomware attack that compromised and damaged servers, forcing the shutdown of affected systems and networks. The company said the incident was confirmed on 22 June and that investigators are assessing the impact on production, shipping, business operations, and whether personal or confidential information was exposed. Nidec added that the subsidiary operates on an independent network and said the attack did not affect Nidec Corporation or other Nidec Group companies.
A previously unknown ransomware group calling itself BlackField claimed responsibility and said it stole 2TB of data from the subsidiary’s IT environment. The group demanded $2 million to delete the data, offered a $5,000-per-day delay before publication, and advertised the full dataset for sale for $400,000, indicating a double-extortion operation. BlackField also reportedly posted sample file structures and documents as proof of theft, although the authenticity of those materials had not been independently verified.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A previously unknown ransomware group calling itself BlackField claimed responsibility for the intrusion, saying it stole 2 TB of data from the subsidiary's IT network. The group demanded $2 million to avoid publication, offered a $5,000-per-day delay option, advertised the full dataset for sale at $400,000, and published sample file structures and documents as proof of theft.
Nidec Corporation confirmed that its Taiwanese subsidiary, Nidec Chaun Choung Technology Corporation, suffered a ransomware attack that compromised and damaged servers, prompting emergency shutdowns of affected servers and networks. The company began investigating possible impacts on production, shipping, business operations, and whether personal or confidential information was exposed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Foxsemicon Integrated Technology Inc. (FITI), a Taiwanese semiconductor parts manufacturer affiliated with Hon Hai Technology Group, said it was hit by a ransomware attack that defaced its website and displayed a threat to leak allegedly stolen data. The attackers, identified in reporting as the **LockBit** ransomware gang, claimed they had stolen and encrypted **5TB** of company data, including customer and employee personal information, and warned they would publish it on a darknet leak site if a ransom was not paid. Foxsemicon told the Taiwan Stock Exchange it restored its website the same day it detected the incident, brought in security experts, and did not expect a significant impact on operations. The company did not disclose any ransom demand and had not confirmed whether customer or employee data was actually exfiltrated, while parts of its website reportedly remained inaccessible and search results continued to show the attackers' message. The incident stood out because website defacement is considered unusual for LockBit, which more commonly pressures victims through its extortion portal.
Jun 29, 2026
Foxconn confirmed that a cyberattack affected several of its North American factories, disrupting operations and forcing some facilities to fall back to manual processes while incident response teams worked to restore systems. Reporting tied to a Wisconsin site said the intrusion caused Wi-Fi and network outages, impaired computer operations, and led employees to use paper-based workflows before some were sent home. Foxconn said it activated cybersecurity response and business continuity measures immediately and that impacted plants are resuming normal production and delivery operations. The **Nitrogen** ransomware group claimed responsibility, alleging it stole **8 TB** of data and more than **11 million documents**, including confidential material related to major technology customers such as **Apple, Intel, Google, Nvidia, and AMD**. Security researchers have described Nitrogen as a financially motivated group first seen in 2023, with ransomware built from leaked **Conti 2** code and earlier links to malware used to deploy **BlackCat/ALPHV**. The incident adds to a string of ransomware attacks previously disclosed by Foxconn, including cases tied to **LockBit** and **DoppelPaymer**.
Jun 29, 2026
Foxconn said operational IT issues disrupted its Mount Pleasant, Wisconsin campus, where workers reported a broad network outage affecting Wi‑Fi, core infrastructure, and timekeeping systems as production was gradually restored. The **Nitrogen** ransomware group later claimed responsibility on its extortion site, alleging it stole **8TB** of data spanning more than **11 million files** from the Racine County facility, including assembly instructions, hardware schematics, and data center topology diagrams tied to customers such as **Apple, Intel, Google, NVIDIA, and Dell**. Foxconn has not verified the authenticity of the leaked samples or disclosed any ransom demand, and reports said the incident may also have affected a Foxconn site in Houston. The claimed breach adds to a pattern of ransomware incidents affecting Foxconn manufacturing operations. In 2022, Foxconn confirmed a ransomware attack at its **Tijuana, Mexico** plant that disrupted production and was claimed by **LockBit**, with the company saying recovery was underway and overall business impact would be limited. That attack followed a 2020 intrusion at Foxconn’s **Ciudad Juárez** facility attributed to **DoppelPaymer**, underscoring repeated targeting of the company’s production sites and raising renewed supply-chain and industrial espionage concerns around its AI server and electronics manufacturing operations.
Jun 29, 2026