Nitrogen Claims Foxconn Data Theft; Company Confirms Factory Cyberattacks
Summary
Nitrogen claimed it stole 8 terabytes of Foxconn data, including customer schematics and project details. Foxconn confirmed cyberattacks affected some North American factories, which were resuming normal production.
Key points
- Nitrogen listed Foxconn on its breach site and claimed to have stolen 8 terabytes of data; the claim was not independently verified in the article.
- The alleged stolen material includes schematics and customer project details tied to Dell, Google, Apple, and Nvidia.
- Foxconn confirmed cyberattacks affected some North American factories and said affected factories were resuming normal production after outages.
- Researchers described Nitrogen as active since 2023 and reported observing about 50 victims, primarily in manufacturing, technology, and retail.
- The article says Nitrogen has connections to ALPHV/BlackCat and that its ransomware program was built from repurposed Conti 2 code.
- Researchers identified a flaw in Nitrogen’s encryption mechanism that can make encrypted data impossible to decrypt; its relevance to the Foxconn incident is unclear.
Article Details
- Victim Organization
- Foxconn
- Incident Type
- Cyberattack with alleged ransomware-related data theft and extortion
- Data Types Exposed
- Schematics
- Customer project details
- Affected Data Size
- Nitrogen claimed to have stolen 8 terabytes of data; the claim was not verified in the article.
- Operational Impact
- Foxconn confirmed that some North American factories suffered a cyberattack and outages. It said the affected factories were resuming normal production.
- Ransom Or Extortion
- Nitrogen listed Foxconn on its breach site and claimed to have stolen data, apparently as part of an extortion attempt. Foxconn did not confirm the theft claim.
- Claim Status
- alleged
People
Allan LiskaThreat intelligence analyst at Recorded Future who commented on ransomware groups targeting supply-chain-impacting organizations and why Foxconn may be targeted.Ian GrayVice president of intelligence at Flashpoint who discussed observations of Nitrogen's activity, estimated victim count, and targeted sectors.
Threat Actors
ALPHVThe article describes Nitrogen as having connections to the ALPHV/BlackCat ransomware group. It does not report ALPHV involvement in the Foxconn incident.BlackCatThe article describes Nitrogen as having connections to the ALPHV/BlackCat ransomware group. It does not report BlackCat involvement in the Foxconn incident.DoppelpaymerThe article reports that DoppelPaymer attacked a Foxconn facility in Mexico in December 2020 and demanded 1,804 bitcoin.LockBitThe article reports that LockBit attacked a Foxconn facility in Mexico in May 2022 and disrupted production. It also attacked Foxconn subsidiary Foxsemicon Integrated Technology in 2024, with defacements and data-breach claims.NitrogenThe group listed Foxconn on its breach site and claimed to have stolen 8 terabytes of data; the theft claim was not verified. The article says Nitrogen also often deploys ransomware that encrypts victims' systems.