Foxconn Hit by Cyberattack, Nitrogen Ransomware Gang Claims Involvement

In a massive blow to the global electronics supply chain, manufacturing giant Foxconn has confirmed a major cyberattack on its North American operations.

The notorious Nitrogen ransomware gang has claimed responsibility, boasting that it stole a staggering 8 terabytes of highly sensitive data from the tech manufacturer’s systems.

The Nitrogen group escalated the situation on Monday by listing Foxconn on its dark web extortion portal. The hackers claimed to have stolen over 11 million files. By Tuesday, Foxconn officially acknowledged the network breach.

A company spokesperson told The Register that some North American factories were attacked. The cybersecurity team immediately activated its incident response protocol and implemented operational measures to keep production moving.

The disruption heavily impacted Foxconn’s facilities in Mount Pleasant, Wisconsin, and Houston, Texas. During the height of the attack, some factory staff were temporarily forced to rely on pen and paper. In contrast, others were instructed to stay home.

Foxconn Cyberattack

The Nitrogen gang claims their massive 8-terabyte haul includes confidential project documents, internal instructions, and technical drawings. The hackers claim this data is tied to major tech companies such as Intel, Google, Dell, and Nvidia.

A closer look at publicly released sample files confirmed the presence of financial documents from the Houston plant. The samples also contained integrated circuit documentation, temperature sensor data, and circuit board layouts.

Most alarmingly, the leaked files included network topology maps for AMD, Intel, and Google projects.

Security analyst Mark Henderson warned that exposing Google and Intel’s network architectures is a serious concern. Because these maps detail operational infrastructure, threat actors could potentially use them to hunt for vulnerabilities in global data centers.

While the hackers claimed to have Apple files, reports from AppleInsider suggest otherwise. The available samples show no signs of Apple circuit diagrams or product data. This aligns with the fact that the Mount Pleasant facility primarily builds data servers and televisions, rather than Apple devices.

The Nitrogen ransomware operation emerged in 2023 and is reportedly built using leaked source code from the Conti version 2 builder. Security researchers suspect the group has strong connections to the ALPHV/BlackCat ransomware ecosystem.

They use a double-extortion tactic, encrypting a victim’s network and threatening to leak the stolen data online if a ransom is not paid, as reported by CSN.

Foxconn reports that the affected factories are currently resuming normal production schedules. However, the company has refused to confirm if any customer data was compromised.

This breach marks at least the third major ransomware incident for Foxconn, highlighting the ongoing security struggles within large-scale electronic supply chains.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.