Foxconn Confirms Attack: 8 TB of Sensitive Data Stolen from Tech Giants

Foxconn, the world's largest electronics manufacturer, has officially confirmed that it suffered a cyberattack affecting some of its facilities in North America.

The company, boasting a revenue of over $260 billion and approximately 900,000 global employees, is once again dealing with an intrusion by a criminal gang into its systems, with potential repercussions that extend far beyond corporate boundaries. A spokesperson for the company stated to Bleeping Computer that response protocols were immediately activated to ensure production continuity, confirming that the affected factories are gradually returning to normal operations.

The severity of the incident emerges from the details released by the ransomware group Nitrogen, which claimed responsibility by publishing the data on its darknet site. According to the attackers, the haul amounts to around 8 TB of data, totaling over 11 million documents. Among these are technical drawings, projects, and confidential instructions belonging to Foxconn’s major clients—names that weigh heavily in the tech market: Apple, Nvidia, Intel, Google, and AMD. If the authenticity of such material is confirmed, it would represent an unprecedented leak of industrial secrets for the Silicon Valley giants.

Who is Nitrogen and Why is Foxconn a Recurring Target

The Nitrogen group emerged in the cybercrime landscape in 2023, initially as a loader to deliver payloads from more well-known groups such as BlackCat/ALPHV. Subsequently, the gang developed its own ransomware strain based on the source code of Conti 2. However, security experts from Coveware have pointed out a significant technical limitation: a programming error in the malware targeting ESXi systems causes files to be encrypted with an incorrect public key, leading to irreversible data corruption instead of mere encryption.

Despite not being the most prolific name in the industry, Nitrogen has steadily expanded its list of victims in the past two years. Unfortunately for Foxconn, this is not a new occurrence but yet another episode in a long series. In January 2024, the subsidiary Foxsemicon became the target of LockBit, the same group that attacked the Tijuana plant in 2022. Going further back, in December 2020, the DoppelPaymer operation paralyzed the CTBG MX facility in Ciudad Juárez, encrypting around 1,400 servers and destroying up to 30 TB of backups. On that occasion, the criminals demanded a record ransom of $34 million.

This latest attack by Nitrogen nevertheless confirms a certain fragility in the global supply chain, where the compromise of a single supplier can expose the industrial plans of the planet's most advanced companies.