Foxconn confirms cyberattack at North American facilities

Electronics manufacturing giant Foxconn confirmed on Monday that it was hit by a cyberattack that may have affected some of its factories. In an official statement, the company disclosed that the security incident impacted its manufacturing facilities located in North America. While the breach disrupted operations, Foxconn reported that “the affected factories are currently resuming normal production.” The company did not immediately respond to specific questions regarding the scope of the disruption, the systems compromised during the incident, or the potential exposure of customer data.

The ransomware gang known as Nitrogen has claimed responsibility for breaching Foxconn’s systems. The group publicized the security breach on its dark web leak site, which it typically uses to identify victims in an effort to extort them. The hackers claim to have stolen over 11 million files during the intrusion. According to Nitrogen, the stolen data includes confidential information belonging to several of Foxconn’s major customers, specifically Apple, Google, Nvidia, Dell, and Intel. To support these claims, the hackers published several images online showing what appear to be product schematics, guidelines, and bank statements.

Nitrogen is characterized as a double-extortion ransomware group. In the context of cybersecurity, double-extortion is a strategy where hackers encrypt a victim’s files to make them inaccessible, but also steal the data before encryption takes place. This approach allows the hacking group to threaten the public release of the stolen data if the victim refuses to pay the ransom. By combining data encryption with the threat of public leaks, groups like Nitrogen establish two distinct avenues to monetize their cybercrimes. If a victim refuses to pay to decrypt their systems, the threat of a public data leak serves as additional leverage to force a payout.

Why it matters

Foxconn is a critical node in the supply chain for major tech giants. This breach highlights the vulnerability of manufacturing infrastructure to double-extortion ransomware tactics.