Ransomware Group Claims Theft of 8 TB of Data From Foxconn

A ransomware group is attempting to extort the electronics manufacturing giant Foxconn, stating that it stole 8 TB of data from the company, including schematics and project details from customers including Dell, Google, Apple, and Nvidia. Foxconn did not immediately respond to a request for comment about the validity of the claims.

The company acknowledged that some of its North American factories suffered a cyberattack in recent days. Affected factories are currently resuming normal production after outages. Foxconn serves as a key manufacturing contractor for electronic components or entire devices.

It holds its own intellectual property as well as that of its customers. The scale of its operations and the sensitive data it maintains make it a frequent target for ransomware and data extortion actors.

The company has faced a number of extortion attempts in recent years. The LockBit group hit another Foxconn facility in Mexico in May 2022 and disrupted production. Most recently, LockBit attacked a subsidiary called Foxsemicon Integrated Technology in 2024 with defacements and data breach claims.

Nitrogen, the group behind the latest incident, emerged in 2023. It has been steadily active with some spikes, including at the end of 2024, and has connections to the ALPHV/BlackCat ransomware group.

In addition to attempting to extort victims by threatening to release stolen data, Nitrogen often deploys traditional ransomware that encrypts a target's systems. Researchers say that the group's ransomware program was built off of widely repurposed Conti 2 code.

The encrypting mechanism has a design flaw that makes it impossible to decrypt data once it has been encrypted. It is unclear if this flaw is a factor in Foxconn's incident response this week. Ransomware and data extortion remain a persistent digital security problem.

Attackers regularly repeat targets and carry out large-scale disruptive attacks. Just last week, thousands of schools around the U.S. were paralyzed amid finals and other year-end activities when the education technology firm Instructure shut down access to its Canvas platform following a breach perpetrated by extortion actors.