Apple supplier Foxconn confirms ransomware attack hit North American factories

CABLE reports that Foxconn has admitted that some of its North American factories “suffered a cyberattack” in recent days, after ransomware group Nitrogen claimed to have stolen 8TB of data from the company. Here are the details.

Foxconn successfully attacked again

According to CABLEa ransomware group known as Nitrogen, claims to have stolen 8TB of data from Foxconn, one of Apple’s main manufacturing partners for the iPhone and other devices.

CABLE says:

A ransomware group is attempting to extort electronics manufacturing giant Foxconn, claiming it stole 8TB of data from the company, including schematics and project details from clients including Dell, Google, Apple and Nvidia.

This is not the first ransomware incident involving Foxconn in recent years. In 2020, for example, a Foxconn facility in Ciudad Juárez, Mexico, was hit by an attack that encrypted servers, stole data and included a demand for bitcoins worth around $34.6 million at the time.

While CABLEThe company’s report does not mention it directly, it appears that the affected factories this time include the one in Mount Pleasant (WI), according to The cybersec guru (via woozad):

The outage first became apparent on Friday, May 1, when workers at the Mount Pleasant campus reported a complete network collapse. By 7:00 a.m. the Wi-Fi was gone. By 11:00 a.m., the disruption had spread to the plant’s main infrastructure.

“We were told to turn off our computers and never log back in for any reason,” said one employee who asked to remain anonymous. “The timecard terminals were dead. We were filling out paper timesheets just to track our hours.”

woozad says that in addition to the Wisconsin plant, it appears a Foxconn plant in Houston, Texas, was also affected.

The site also states that while Nitrogen has published a set of sample files purportedly from Foxconn, Apple-related documents do not appear to be present there:

It is unclear whether there are any files directly related to existing or future Apple projects. This ultimately isn’t really surprising, given that Foxconn’s Mount Pleasant factory mainly produces TVs and data servers rather than Apple devices.

The attack is the latest in a series of cyberattacks and extortion attempts involving Foxconn facilities in recent years. Here is CABLE Again:

The idea of Foxconn as a primary target is not just conceptual. The company has faced a number of extortion attempts, including a December 2020 attack on a Mexican facility in which the DoppelPaymer ransomware group memorably demanded 1,804 Bitcoins (worth approximately $34 million at the time). The LockBit group struck another Foxconn factory in Mexico in May 2022 and disrupted production. Most recently, LockBit attacked a subsidiary called Foxsemicon Integrated Technology in 2024 with allegations of defacement and data breaches.

Foxconn, for its part, did not confirm the extent of the incident, but said CABLE that the factories concerned are “currently resuming normal production”.