Foxconn Confirms Cyberattack Disrupted North American Factories; Nitrogen Claims Data Theft
Summary
Foxconn confirmed a cyberattack disrupted some North American factories, which are resuming production. Nitrogen claims it stole 8 TB of data, but Foxconn has not confirmed data impact; researchers questioned the group’s theft claims.
Key points
- Foxconn confirmed a cyberattack disrupted some of its North American factories; affected sites are resuming normal production.
- Nitrogen claims it stole 8 TB across more than 11 million files, but Foxconn has not confirmed data theft or described the affected systems.
- Nitrogen said the allegedly stolen materials included confidential projects and files associated with Intel, Apple, Google, Dell and Nvidia; those companies did not comment.
- A ransomware researcher said recent Nitrogen claims lacked working file listings and relied mostly on older file images, raising questions about whether the group is exaggerating theft claims.
- Foxconn said its cybersecurity team responded with measures intended to maintain production and delivery; it did not confirm a ransom demand.
Article Details
- Victim Organization
- Foxconn
- Incident Type
- Cyberattack that disrupted some North American factories. Nitrogen claimed ransomware-related data theft, which Foxconn has not confirmed.
- Data Types Exposed
- Nitrogen claimed it stole confidential instructions, projects, and drawings, allegedly including materials related to Intel, Apple, Google, Dell, and Nvidia; Foxconn did not confirm the data theft.
- Affected Records
- Nitrogen claimed the stolen data comprised more than 11 million files; this was not confirmed by Foxconn.
- Affected Data Size
- Nitrogen claimed it stole 8 terabytes of data; this was not confirmed by Foxconn.
- Operational Impact
- Some Foxconn factories in North America were disrupted. Foxconn said affected factories were resuming normal production and that its cybersecurity team took measures to ensure continuity of production and delivery.
- Ransom Or Extortion
- Foxconn did not confirm a ransom demand. Nitrogen claimed data theft; a researcher questioned whether the group was inflating its theft claims to pressure victims into paying higher ransoms.
- Claim Status
- confirmed
People
Cynthia KaiserHalcyon’s Ransomware Research Center senior vice president who discussed Nitrogen’s history and questioned whether its recent data-theft claims were inflated.Ismael ValenzuelaArctic Wolf Labs vice president of threat research and intelligence who described Nitrogen’s reported operational playbook.
Threat Actors
Malware
BlackCatNitrogen was first observed in 2023, using ALPHV, one of the most prevalent ransomware variants at that time, Cynthia Kaiser, senior vice president at Halcyon’s Ransomware Research Center, told CyberScoop.ContiThe group started using stolen code from Conti, another formerly prolific ransomware variant, in 2024 to build its own custom attack tools to hit Windows and VMware server environments, she added.