Foxconn Nitrogen ransomware breach (2026)

In May 2026, the Nitrogen ransomware group posted on its dark-web leak site that it had breached Foxconn — the world's largest contract electronics manufacturer and a key supplier to virtually every major consumer-tech brand — and exfiltrated over 11 million files from its North American facilities.

What happened

Nitrogen is a double-extortion crew: it both encrypts files and steals data to pressure victims into paying. On 13 May 2026 it published a claim that it held 11M+ files from Foxconn's North American operations. According to the public posting, the stolen archive includes confidential information belonging to Foxconn customers — names cited include Apple, Dell, Google, Intel, Nvidia, and Sony — the kind of supply-chain data that competitors and nation-state collectors would pay handsomely to read.

Foxconn confirmed that a cyberattack had affected facilities in North America and said the affected factories were "currently resuming normal production" but declined to answer detailed questions.

Impact

• Over 11 million files claimed stolen by Nitrogen.
• North American Foxconn facilities affected; production reportedly recovering.
• Customer data implicated for six of the largest consumer-tech brands.
• No public ransom amount disclosed; Foxconn has not confirmed payment or non-payment.

Why it matters

Contract manufacturers like Foxconn are an upstream concentration point in the global tech supply chain. A breach of one factory operator can simultaneously hand attackers confidential roadmaps, BOMs, and pricing data for dozens of brands. The Nitrogen extortion playbook — leak-site claim first, factory recovery in parallel — is now the default shape of every large-scale manufacturer ransomware incident.