- Nitrogen ransomware gang claims to have stolen 11 million files from Foxconn – including component designs and schematics for Google, Intel, Apple, Nvidia, and Dell products.
- The Wisconsin Foxconn plant suffered a multi-day IT outage starting May 1 that halted production, as cybersecurity experts suspect a ransomware attack behind the disruption.
- Data samples appear to show genuine Google component documentation, though security researchers have not yet confirmed the hackers’ claims about Apple, Dell, or Nvidia being affected.
Foxconn, a leading electronics manufacturer that supplies Apple, Google, Nvidia, and other companies, has allegedly suffered a breach, as the Nitrogen ransomware group adds the company to their dark web extortion blog. According to the hackers, they have obtained about 11 million files containing 8 terabytes of sensitive data from Foxconn in Taiwan.
Leaked information includes classified documents, schematics, and documents related to projects from Foxconn to various clients such as Intel, Apple, Google, Dell, Nvidia, etc. The breach occurred within days of the Foxconn Wisconsin facility experiencing a significant, multi-day network outage that caused production to stop.
Data Samples Reveal Component Details for Major Tech Brands
Nitrogen published screenshots alongside their dark web post as proof of the breach. Cybersecurity researchers analyzed these samples and confirmed that at least some of the documents appear authentic. The images show hardware component descriptions, technical schematics, investment paperwork, and financial operation records.
The research team noted that several samples depict components manufactured specifically for Google. However, an initial review did not immediately support the hackers’ claims that Apple, Dell, or Nvidia also appear in the stolen data set.
Security experts warn that verified leaks of this nature could cause serious damage to Foxconn and its clients, competitors, or counterfeit manufacturers could use the stolen schematics to produce knockoff components.
More alarmingly, threat actors could study the leaked technical data to discover previously unknown zero-day vulnerabilities and exploit them without anyone’s knowledge.
The espionage potential of ransomware attacks is often overlooked. Iran-linked hackers recently used Chaos ransomware to hide a broader espionage operation, demonstrating that data theft, not ransom, is sometimes the real objective.
Wisconsin Plant Outage May Signal Ransomware Connection
Foxconn’s Mount Pleasant campus in Wisconsin experienced significant IT problems in early May. Media reports indicate that the disruption forced the manufacturing center to shut down its systems entirely.
Assembly line operators and office workers noted that the outage brought production to a complete halt, with some employees unable to work for several days.
The problems reportedly began on May 1 and persisted through the first weekend of the month. The issues grew severe enough that employees received instructions to use personal hotspots for internet connectivity. Foxconn reportedly described the incident internally as an IT network problem.
No official confirmation links the Wisconsin outage to the Nitrogen ransomware listing – but cybersecurity experts point to several telltale signs. Extended downtime and halted operations often indicate a ransomware attack.
Also, threat actors routinely disrupt manufacturing capabilities to pressure companies into paying ransoms; they know that clients may penalize them for missed production deadlines.
Ransomware Group Operates Double Extortion Model from Eastern Europe
Nitrogen first appeared in the cybersecurity threat landscape three years ago, operating as a Ransomware-as-a-Service (RaaS) product. The group utilizes a double extortion strategy – stealing victim data while simultaneously encrypting their systems to push targets toward paying ransoms.
Security researchers have not definitively identified the individuals behind Nitrogen; however, evidence suggests links to ransomware operators based in Eastern Europe.
Some analysts believe certain members may have connections to the infamous BlackHat and ALPHV ransomware cartel.
Foxconn issued a statement to TMJ4 regarding the Wisconsin incident. The company explained that its information technology systems at the Wisconsin sites experienced a technical issue affecting normal operations.
Further, their officials indicated that they activated emergency response plans and initiated contingency actions to continue production and secure their data.
The Taiwanese electronics giant has not yet responded to the specific claims the Nitrogen Ransomware group made on its dark web blog.
Foxconn is a major player in the supply chains of many leading technology companies, so any confirmed breach will significantly impact many companies across the industry.
