INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Foxconn hit by Nitrogen ransomware gang cyberattack

| 2026-05-13 12:49 HIGH LOW RANSOMWARE & EXTORTION DATA BREACH
JSON
Executive Summary
AI-generated
On 2026-05-13, Foxconn confirmed a cyberattack claimed by the Nitrogen ransomware gang, which had stolen 8 TB of data and over 11 million documents. The attack affected some North American factories, with the company's spokesperson stating that the cybersecurity team activated response measures to ensure production continuity. This incident is not the first time Foxconn has been hit by ransomware, as previously reported in January 2024 when LockBit claimed to have targeted a Foxsemicon subsidiary and in late May 2022 when another plant was attacked. The Nitrogen ransomware operation, which emerged in 2023, had added dozens of victims to its leak site since 2024.
Technical Mitigations AI-generated
• Patch ESXi to prevent the coding mistake that corrupts files with the wrong public key. • Monitor for AI chained exploits that bypass renderer and OS sandboxes. • Block or hunt for indicators of Nitrogen ransomware operations, such as leaked Conti 2 builder code.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
BlackCatBlackCatALPHVALPHVContiConti
Target & Sectors
MX
manufacturingmanufacturing technologytechnology
Incident Timeline
‎2026/05/13
Foxconn confirms a cyberattack claimed by the Nitrogen ransomware gang, which allegedly stole 8 TB of data and more than 11 million documents.
data_breach 8 TB
The incident was confirmed by a Foxconn spokesperson when BleepingComputer asked the company to confirm claims by the Nitrogen ransomware operation earlier this week that they had stolen 8 TB of data and more than 11 million documents.
financial $34 ransom
In December 2020, the DoppelPaymer ransomware operation also claimed it hit Foxconn's CTBG MX facility in Ciudad Juárez and demanded a $34 million ransom after allegedly stealing 100GB of data, encrypting up to 1,400 servers, and destroying 20 to…
data_breach 100 GB
In December 2020, the DoppelPaymer ransomware operation also claimed it hit Foxconn's CTBG MX facility in Ciudad Juárez and demanded a $34 million ransom after allegedly stealing 100GB of data, encrypting up to 1,400 servers, and destroying 20 to…
data_breach 30 TB
In December 2020, the DoppelPaymer ransomware operation also claimed it hit Foxconn's CTBG MX facility in Ciudad Juárez and demanded a $34 million ransom after allegedly stealing 100GB of data, encrypting up to 1,400 servers, and destroying 20 to…
infrastructure 1,400 servers
…DoppelPaymer ransomware operation also claimed it hit Foxconn's CTBG MX facility in Ciudad Juárez and demanded a $34 million ransom after allegedly stealing 100GB of data, encrypting up to 1,400 servers, and destroying 20 to 30TB of backup data.
victims 900,000 employees
The electronics giant has over 900,000 employees across over 240 campuses in 24 countries and reported revenues of over $260 billion in 2025.
Tactical Metrics
Metrics
data_breach
8
Tb
The incident was confirmed by a Foxconn spokesperson when BleepingComputer asked the company to confirm claims by the Nitrogen ransomware operation earlier this week that they had stolen 8 TB of data and more than 11 million documents.
Metrics
financial
34,000,000
Ransom
In December 2020, the DoppelPaymer ransomware operation also claimed it hit Foxconn's CTBG MX facility in Ciudad Juárez and demanded a $34 million ransom after allegedly stealing 100GB of data, encrypting up to 1,400 servers, and destroying 20 to…
Metrics
data_breach
100
Gb
In December 2020, the DoppelPaymer ransomware operation also claimed it hit Foxconn's CTBG MX facility in Ciudad Juárez and demanded a $34 million ransom after allegedly stealing 100GB of data, encrypting up to 1,400 servers, and destroying 20 to…
Metrics
infrastructure
1,400
Servers
…DoppelPaymer ransomware operation also claimed it hit Foxconn's CTBG MX facility in Ciudad Juárez and demanded a $34 million ransom after allegedly stealing 100GB of data, encrypting up to 1,400 servers, and destroying 20 to 30TB of backup data.
Metrics
data_breach
30
Tb
In December 2020, the DoppelPaymer ransomware operation also claimed it hit Foxconn's CTBG MX facility in Ciudad Juárez and demanded a $34 million ransom after allegedly stealing 100GB of data, encrypting up to 1,400 servers, and destroying 20 to…
Metrics
victims
900,000
Employees
The electronics giant has over 900,000 employees across over 240 campuses in 24 countries and reported revenues of over $260 billion in 2025.
Intelligence Sources
BleepingComputer 2026-05-13