The factory in Mount Pleasant, Wisconsin, was back to normal production by May 12. The 8 terabytes of data stolen from its network were not coming back.

Foxconn — the world’s largest electronics manufacturer, physically building devices for Apple, Nvidia, Google, Dell, Intel, and dozens of others — confirmed this week that its North American operations were hit by a ransomware attack. A group calling itself Nitrogen claims to have walked out with 11 million files: assembly instructions, hardware schematics, and network topology diagrams belonging to some of the most valuable technology companies on Earth.

What happened at Mount Pleasant

The breach first surfaced on Friday, May 1. Workers at Foxconn’s Racine County campus reported a full network collapse — Wi-Fi cut off at 7 AM, core plant infrastructure disrupted by 11 AM. Staff were told to power down their computers and stay offline. Timecard terminals went dark. Employees filled out paper timesheets.

“We were told to turn off our computers and not log back in under any circumstances,” one worker told The CyberSec Guru, asking not to be identified. “The timecard terminals were dead.”

Internal notices cited ongoing network problems through at least Tuesday, May 5. The facility had recently received a $569 million investment to ramp up AI server and cloud infrastructure production, placing it at the center of the domestic high-performance computing supply chain. The outage hit in the middle of that build-out.

On May 11, Nitrogen listed Foxconn on its dark web extortion site and released sample files as proof. Analysts who reviewed the samples describe step-by-step assembly guides for proprietary server hardware, network topology diagrams for Google and Intel data centers, and design schematics for components linked to Apple, Nvidia, and Dell.

Mark Henderson, a cybersecurity analyst tracking the group, told The CyberSec Guru that the topology specs are “architectural maps of live infrastructure.” If authentic, they could be used to locate vulnerabilities in data centers worldwide.

Foxconn has not confirmed whether the sample files are genuine. Apple, Google, Intel, Nvidia, and Dell have not publicly commented.

The concentration problem

Foxconn is the textbook single point of failure in global technology manufacturing. The company doesn’t just make products — it holds the intellectual property of its clients in the form of schematics, assembly instructions, and design files that represent billions of dollars in R&D.

“Ransomware groups are increasingly targeting victims that can impact the supply chain, whether it is physical or software,” Allan Liska, a threat intelligence analyst at Recorded Future, told WIRED. Foxconn, he noted, “does manufacturing and holds sensitive data for so many companies around the world.”

One breach. One target. The blast radius covers half of Silicon Valley.

Ian Gray, vice president of intelligence at Flashpoint, said Nitrogen has logged roughly 50 victims since emerging in 2023, primarily targeting manufacturing, technology, and retail. Manufacturing, he said, is “one of the most-targeted sectors for ransomware in general.”

A recurring target

Foxconn has been here before. In December 2020, DoppelPaymer hit a facility in Ciudad Juárez, Mexico, demanding $34 million and reportedly deleting 30 terabytes of backup data. LockBit disrupted production at a Baja California plant in May 2022, then attacked Foxconn subsidiary Foxsemicon Integrated Technology in 2024. Three major ransomware incidents in six years, all targeting North American manufacturing.

The push toward IoT-integrated, cloud-connected production — the so-called Industry 4.0 model — has expanded the attack surface each time.

The data is already gone

Nitrogen typically spends weeks inside a target’s network before triggering visible disruption, prioritizing data exfiltration over immediate encryption. Entry is usually through compromised VPNs or remote desktop access. Once inside, the group moves laterally to locate backup servers and file repositories, staging data quietly.

By the time anyone noticed at Mount Pleasant, the files were almost certainly already exfiltrated.

There is an additional wrinkle. According to Coveware, Nitrogen’s encryption mechanism has a critical design flaw: the public key used during encryption gets corrupted, making files impossible to decrypt even if the victim pays. Whether this has complicated Foxconn’s incident response is unclear.

On the consumer side, analysts have found no evidence of personal data — user accounts or customer information — in the theft. The files appear to be exclusively industrial. AppleInsider’s analysis suggests Apple-specific data may be limited, since the Wisconsin facility primarily produces televisions and data servers rather than iPhones. But the published samples represent a fraction of 8 terabytes. The full scope is unknown.

Nitrogen has not published a payment demand. Whether the group sells the data, leaks it, or simply holds it as leverage is unclear.

Foxconn said it “immediately activated emergency response mechanisms and implemented a series of contingency measures to ensure the continuity of production and delivery, as well as the protection of data.” The factories are running again. Whether the secrets are still secret is another question.

Sources