Foxconn breach exposes supply chain risks

Foxconn has confirmed a cyberattack on some of its North American factories after the Nitrogen ransomware group claimed it stole 8 terabytes of data and more than 11 million files from the world’s largest electronics contract manufacturer.

The company said its cybersecurity team activated response measures to protect production and deliveries, with affected factories returning to normal operations. The statement did not identify the number of sites hit, the point of intrusion, whether customer data was compromised, or whether any ransom demand had been received.

Nitrogen listed Foxconn on its dark web leak site this week, claiming the stolen files included confidential instructions, project data, drawings and technical material linked to major technology customers, including Apple, Nvidia, Google, Dell, Intel and AMD. Screenshots posted by the group were presented as proof of access, though the full scale and authenticity of the material have not been independently verified.

The attack has sharpened concerns over cyber exposure inside global hardware supply chains, where a single manufacturer may hold design files, production schedules, supplier documents and engineering data for several major brands. Foxconn’s position makes the incident more than a conventional corporate breach. It raises questions over how client intellectual property is segmented, monitored and protected across manufacturing networks spread across multiple jurisdictions.

Foxconn, formally Hon Hai Precision Industry, reported full-year 2025 revenue of NT$8.1 trillion, up 18 per cent from a year earlier, reflecting strong demand from artificial intelligence servers, cloud and networking products, and consumer electronics. The company operates more than 240 campuses across 24 countries and employs about 900,000 people during peak manufacturing periods.

North America forms a strategic part of Foxconn’s manufacturing footprint, with operations in the United States and Mexico. The disruption first emerged as technical problems at a Wisconsin facility, where network outages forced some workarounds before the company confirmed a cyberattack. The group has operations across Wisconsin, Ohio, Texas, Virginia, Indiana and Mexico, though Foxconn has not disclosed which sites were affected.

Nitrogen is regarded as a financially motivated ransomware operation with links to earlier malware activity associated with ALPHV/BlackCat infrastructure. The group has been tied to attacks on manufacturing, technology, retail and finance targets, using data theft and encryption to pressure victims. Some security researchers have also flagged technical weaknesses in parts of its ransomware tooling, including flaws that may make encrypted data unrecoverable in certain circumstances.

The Foxconn incident follows a pattern of ransomware groups targeting companies whose disruption can ripple across broader commercial networks. Manufacturers have become attractive targets because they often operate with complex legacy systems, high uptime requirements, distributed plants and extensive supplier access. Even when core production continues, temporary loss of internal systems can slow logistics, procurement, scheduling, quality control and engineering workflows.

Foxconn has faced ransomware pressure before. Its Mexican operations were attacked in 2020 and 2022, while its semiconductor segment was hit by LockBit in 2024. These earlier cases underline a persistent challenge for large manufacturers: cyber resilience must cover not only headquarters systems but also factory networks, subsidiaries, contractors and region-specific infrastructure.

The latest breach also comes as Foxconn deepens its exposure to AI infrastructure. Its cloud and networking products have become a major growth driver as demand rises for AI servers and related components. That shift may increase the sensitivity of the information moving through its plants, particularly where customer designs, chip platforms, rack-level configurations and production forecasts are involved.

Technology customers named by Nitrogen have not publicly confirmed that their proprietary information was included in the stolen material. The distinction matters. Ransomware groups often inflate claims to strengthen extortion pressure, while companies typically avoid disclosing technical detail before forensic reviews are complete. Verification may take weeks as investigators compare leaked samples, access logs, file hashes and internal records.

For Foxconn’s customers, the immediate concern is whether any leaked files could expose product road maps, design specifications, factory processes or security-sensitive supply chain data. Even partial engineering documents can be valuable to competitors, counterfeiters or hostile actors if they reveal component selection, architecture, testing routines or supplier relationships.

The company’s assurance that affected factories are resuming production is likely to limit fears of immediate supply shortages. Yet the larger test will be whether Foxconn can show that the intrusion was contained, that customer material was not materially exposed, and that attackers no longer retain access to connected systems.