Summary
Taiwanese electronics manufacturing giant Foxconn has confirmed a cyberattack affecting several of its North American factories after the Nitrogen ransomware group publicly claimed responsibility. The group alleges it exfiltrated 8 terabytes of data comprising more than 11 million files, including confidential project documentation and technical drawings tied to major customers such as Apple, NVIDIA, Intel, Google, and Dell Technologies.
Foxconn stated that impacted facilities are returning to normal operations but has not confirmed whether customer data was compromised. The attack came just days after West Pharmaceutical Services disclosed a separate ransomware incident that disrupted its global manufacturing, shipping, and receiving operations — underscoring a sharp uptick in ransomware targeting the manufacturing sector in 2026.
West Pharmaceutical filed with the SEC confirming data exfiltration and system encryption after an intrusion detected on May 4. The company engaged Palo Alto Networks Unit 42 for incident response and has since restored core enterprise systems, though full recovery timelines remain unclear.
Sources
- Industrial Cyber — Ransomware attacks on West Pharmaceutical and Foxconn
- CISO Series — Foxconn Factory Attacks
Commentary
The Nitrogen group targeting Foxconn is particularly alarming because of the supply chain implications. Foxconn manufactures hardware for virtually every major tech company on the planet — if those 8TB of stolen files contain genuine technical drawings and project specs for Apple, NVIDIA, and Intel products, the downstream impact could be enormous. Leaked hardware schematics could enable counterfeit manufacturing, reveal unreleased product designs, or expose security-relevant architecture details.
The simultaneous hit on West Pharmaceutical, a critical healthcare supply chain player, reinforces that ransomware gangs are deliberately selecting targets where operational disruption creates maximum pressure to pay. Manufacturing is becoming the new healthcare in the ransomware targeting playbook — companies that simply cannot afford extended downtime.