Foxconn Confirms Nitrogen Ransomware Attack on North American Factories with 8 TB Data and 11 Million Documents Stolen

Overview

Foxconn, the world’s largest electronics manufacturer, has confirmed that some of its North American factories suffered a cyberattack claimed by the Nitrogen ransomware group according to BleepingComputer. The company stated that its cybersecurity team activated response measures and that affected factories are currently resuming normal production as reported by BleepingComputer and SecurityWeek.

Nitrogen, which listed Foxconn on its Tor-based leak site earlier this week, claims to have stolen 8 TB of data comprising more than 11 million files, including confidential instructions, projects, and drawings belonging to customers such as Apple, Intel, Google, Nvidia, AMD, and Dell per BleepingComputer and SecurityWeek. WIRED also reported the claims of 8 terabytes of data with schematics and project details from customers including Dell, Google, Apple, and Nvidia according to WIRED.

What We Know

• Foxconn has over 900,000 employees across more than 240 campuses in 24 countries, reported revenues of over $260 billion in 2025, and is ranked 28th in the Fortune Global 500, manufacturing products for major tech companies including Apple, Nvidia, Intel, and Google as detailed by BleepingComputer.
• The Nitrogen ransomware operation first surfaced in 2023 as a malware loader that deployed BlackCat/ALPHV payloads and later developed its own strain using leaked Conti 2 builder code according to BleepingComputer.
• Nitrogen has been active since late 2024, with its leak site listing a few dozen victims primarily in manufacturing, technology, and finance sectors; it typically targets North America and Western Europe and has connections to the ALPHV/BlackCat group per WIRED and SecurityWeek.
• Security researchers at Flashpoint observed approximately 50 Nitrogen victims since the group launched, with manufacturing as one of the most-targeted sectors for ransomware in general according to WIRED.
• “Ransomware groups are increasingly targeting victims that can impact the supply chain, whether it is physical or software,” said Allan Liska of Recorded Future. “So it’s unsurprising that a company like Foxconn would be targeted, since it does manufacturing and holds sensitive data for so many companies around the world” as quoted in WIRED.
• This marks the latest in a series of ransomware incidents involving Foxconn: LockBit claimed a hit on subsidiary Foxsemicon in January 2024 and on a Tijuana, Mexico plant in May 2022; DoppelPaymer targeted a Ciudad Juárez facility in December 2020 and demanded a $34 million ransom reported by BleepingComputer.
• Foxconn subsidiary Foxsemicon was targeted by a ransomware gang in 2024 per SecurityWeek.
• Nitrogen has published several screenshots on its leak site to support its claims regarding the Foxconn data according to SecurityWeek.

What We Don’t Know

• Foxconn’s public statements have not explicitly confirmed the volume of data stolen (8 TB / 11+ million files), the specific contents, or directly attributed the incident to Nitrogen, though the company acknowledged the cyberattack on North American factories.
• It remains unclear whether a ransom was demanded, paid, or if any data has been published beyond the samples shown by the attackers.
• The full operational impact, including any specific factory locations affected (reports mention sites in Wisconsin and other states as well as Mexico), and whether the encryption component of the attack succeeded or was mitigated, has not been detailed publicly by Foxconn.
• Details on how the initial access was achieved (e.g., via malvertising, DLL sideloading, or other vectors associated with Nitrogen) have not been disclosed in available reporting.

Analysis

The incident underscores the attractiveness of large manufacturing and supply-chain companies to ransomware and data-extortion groups. As a contract manufacturer handling sensitive intellectual property and schematics for numerous high-profile clients, Foxconn represents a high-value target whose compromise could affect downstream partners across the electronics industry.

Nitrogen’s profile as a double-extortion actor (data theft plus encryption) with roots in the broader ransomware ecosystem highlights persistent risks for the sector. Manufacturing remains one of the most-targeted industries, according to threat intelligence firms tracking the group.

The company’s history of prior incidents demonstrates that even major global players with significant resources continue to face disruptive attacks, reinforcing the need for robust validation of security controls beyond basic patching and detection.

Foxconn stated it has activated its incident response and implemented measures to maintain production continuity, with affected sites resuming operations. As of the latest reports, no further updates on negotiations or data publication have emerged from the Nitrogen leak site.