# Foxconn North American Factories Cyberattack — Nitrogen Ransomware Claims 8 TB / 11M+ Documents Stolen, Including Network Topologies for AMD/Intel/Google

> Foxconn (Hon Hai Precision Industry) confirmed on 2026-05-12 that some of its North American factories — specifically the Mount Pleasant, Wisconsin and Houston, Texas plants — were hit by a cyberattack after the Nitrogen ransomware operation listed the company on its dark-web data-leak site on 2026-05-11 claiming theft of 8 TB and more than 11 million documents. Sample files released by Nitrogen include financial documents from the Houston facility, circuit-board layouts, temperature-sensor data, integrated-circuit documentation, technical drawings for Intel/Apple/Google/Dell/Nvidia projects, and — most concerning to analysts — network-topology maps for AMD, Intel and Google projects that could enable downstream attacks against operational data-center infrastructure. Nitrogen is a Conti 2-builder-derived double-extortion operation active since 2023 with prior ties to the BlackCat/ALPHV ecosystem; Coveware previously documented a coding bug in Nitrogen's ESXi encryptor that uses the wrong public key and irrevocably corrupts victim files, meaning ransom payment cannot guarantee recovery.

- **Published:** 2026-05-13T12:00:00Z
- **Last reviewed:** 2026-05-13T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0511
- **ID:** TL-2026-0511
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Nitrogen
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-37085

## Description

On Monday 2026-05-11 the Nitrogen ransomware operation added Foxconn (officially Hon Hai Precision Industry Co., Ltd. — Fortune Global 500 #28, the world's largest electronics manufacturer, with approximately 900,000 employees and ~US$260B in 2025 revenue) to its Tor-hosted data-leak site. Nitrogen's post claimed exfiltration of 8 terabytes comprising more than 11 million documents from Foxconn's North American operations, accompanied by a sample-file pack intended to validate the claim and pressure payment.

On Tuesday 2026-05-12 a Foxconn spokesperson confirmed the incident to BleepingComputer, The Register, TechCrunch and other outlets, stating: "Some of Foxconn's factories in North America suffered a cyberattack." Multiple sources subsequently identified the impacted sites as the Mount Pleasant, Wisconsin facility (which manufactures televisions and servers, not Apple devices) and the Houston, Texas factory. Foxconn stated it "immediately activated the response mechanism" and that "affected factories are currently resuming normal production," but during the disruption staff at the affected sites reportedly operated on pen-and-paper while production systems were unavailable. Foxconn declined to confirm whether customer data was actually compromised.

The sample data Nitrogen released to validate the breach reportedly contains: (a) financial documents from the Houston facility, (b) circuit-board layouts and integrated-circuit documentation, (c) temperature-sensor data from manufacturing processes, (d) technical drawings labelled with Intel, Apple, Google, Dell, AMD and Nvidia project identifiers, and (e) — most operationally significant — network-topology diagrams for AMD, Intel and Google projects. Security analyst Mark Henderson warned: "The real concern is that Google and Intel's network topologies have been stolen. Because this is an architectural map of operational infrastructure, attackers could use this data to identify vulnerabilities in data centers around the world." AppleInsider and 9to5Mac noted that despite Nitrogen's framing, the released samples do not appear to contain Apple-specific industrial-design data, and the Mount Pleasant plant does not produce iPhones.

Nitrogen first surfaced in 2023 as a malicious loader masquerading as IT-administration software (WinSCP, AnyDesk, Cisco AnyConnect, Slack, Treesize, FileZilla) distributed via malvertising and SEO-poisoning on Google Ads and Bing. Initial campaigns deployed BlackCat/ALPHV as the terminal payload, leading analysts to assess Nitrogen as an affiliate or close partner of that operation. After the ALPHV implosion (exit-scam, March 2024) Nitrogen pivoted to operating its own ransomware strain derived from the leaked Conti v2 builder, with cross-platform variants targeting Windows hosts and ESXi hypervisors. The group runs a classic double-extortion model: data exfiltration via Rclone/Mega cloud-sync, hands-on-keyboard intrusion using Cobalt Strike, Sliver and Brute Ratel C4 implants, deployment of the Nitrogen ESXi locker against virtualization fabric, and a Tor-hosted leak portal for payment pressure. In February 2026 Coveware published research demonstrating that Nitrogen's ESXi encryptor contains a cryptographic implementation bug in which the public key used for file encryption does not correspond to the operator's private decryption key, meaning encrypted ESXi virtual machines cannot be recovered even if the ransom is paid. This places victims that experienced ESXi-stage encryption in a no-win position and elevates the relative importance of resisting the data-extortion vector.

Foxconn has prior experience with ransomware: LockBit affiliates compromised Foxconn subsidiaries in 2022 (Foxconn Baja California, Tijuana plant) and 2024. The 2026 Nitrogen incident is materially worse from a supply-chain perspective because of the volume of customer-adjacent technical material in the claimed dataset — particularly the network topology maps that, if authentic, expose architectural details of customer infrastructure to follow-on attackers. The exact initial-access vector for the Foxconn intrusion has not been publicly disclosed by either Foxconn or Nitrogen; however, prior Nitrogen incidents have begun with malicious-installer downloads by IT administrators searching for legitimate tooling, followed by Python-based loader execution, Cobalt Strike beacon implantation, internal reconnaissance, credential harvesting (Mimikatz, LSASS dumping, NTDS.dit extraction), lateral movement via SMB/WMI/RDP, mass file collection, Rclone-based exfiltration to attacker-controlled cloud storage, then Nitrogen-locker deployment across both Windows and ESXi tiers.

This threat record is distinct from TL-2026-0105 (Nitrogen ESXi encryptor cryptographic-bug analysis); the present record documents the Foxconn victim incident, its scope, its supply-chain blast radius (AMD, Intel, Google, Apple, Dell, Nvidia customer references), and the Nitrogen TTPs relevant to defenders monitoring for similar intrusion patterns in manufacturing and contract-electronics environments.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1591 Gather Victim Org Information
- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1588 Obtain Capabilities
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1569 System Services
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1548 Abuse Elevation Control Mechanism
- T1484 Domain or Tenant Policy Modification
- T1036 Masquerading
- T1574 Hijack Execution Flow
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1003 OS Credential Dumping
- T1087 Account Discovery
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1083 File and Directory Discovery
- T1021 Remote Services
- T1039 Data from Network Shared Drive
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1657 Financial Theft

## Sources

- [Electronics giant Foxconn confirms cyberattack on North American factories (BleepingComputer, Sergiu Gatlan)](https://www.bleepingcomputer.com/news/security/electronics-giant-foxconn-confirms-cyberattack-on-north-american-factories/)
- [Foxconn Confirms Cyberattack After Nitrogen Ransomware Gang Claim (Cyber Security News, Guru Baran)](https://cybersecuritynews.com/foxconn-confirms-cyberattack/)
- [Foxconn confirms cyberattack after ransomware crew claims it stole confidential Apple, Nvidia files (The Register)](https://www.theregister.com/cyber-crime/2026/05/12/foxconn-confirms-cyberattack-after-nitrogen-claims-apple-nvidia-data-theft/5239144)
- [Ransomware hackers claim breach at Foxconn, a major electronics manufacturer for Apple, Google, and Nvidia (TechCrunch)](https://techcrunch.com/2026/05/13/ransomware-hackers-claim-breach-at-foxconn-a-major-electronics-manufacturer-for-apple-google-and-nvidia/)
- [Apple Project Files Allegedly Stolen in Foxconn Ransomware Attack (MacRumors)](https://www.macrumors.com/2026/05/13/apple-files-stolen-foxconn-ransomware-attack/)
- [Apple supplier Foxconn confirms ransomware attack affected North American factories (9to5Mac)](https://9to5mac.com/2026/05/12/apple-supplier-foxconn-confirms-ransomware-attack-affected-north-american-factories/)
- [Victim: FOXCONN — nitrogen (ransomware.live tracker entry)](https://www.ransomware.live/id/Rk9YQ09OTkBuaXRyb2dlbg)
- [Coveware analysis of Nitrogen ESXi encryptor cryptographic implementation bug (February 2026)](https://www.coveware.com/blog/nitrogen-ransomware-esxi-decryptor-flaw)
- [Trend Micro analysis of Nitrogen Ransomware loader (2024)](https://www.trendmicro.com/en_us/research/24/i/nitrogen-malware-loader.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0511