Foxconn Hit Again: Inside the Nitrogen Ransomware Attack That Touched Apple, Nvidia, and Intel

On May 11, 2026, a ransomware group called Nitrogen posted an entry on its dark web leak site, NitroBlog, naming a familiar target: Foxconn, the world’s largest contract electronics manufacturer. The group claimed to have stolen 8 terabytes of data across more than 11 million files. Foxconn confirmed the intrusion the next day.

What was hit

The attack disrupted several of Foxconn’s North American facilities, including sites in Mount Pleasant, Wisconsin and Houston, Texas. Workers were told to shut down computers, timecard systems went offline, and some employees switched to paper-based workflows while systems were restored.

The alleged stolen files reportedly include circuit board layouts, engineering schematics, network topology documentation, and financial records tied to some of Foxconn’s biggest clients — Apple, Nvidia, Intel, Google, AMD, and Dell. Foxconn has not confirmed that any specific customer’s data was taken.

Not Foxconn’s first rodeo

This is the fourth documented ransomware incident against Foxconn or its subsidiaries since 2020:

• 2020: DoppelPaymer hit a Mexican facility with a $34 million ransom demand.

• 2022: LockBit struck another Mexican site.

• 2024: LockBit hit Foxsemicon, a Foxconn subsidiary.

• 2026: Nitrogen hits North American operations.

Each attack has targeted a different geography with a different threat actor — a pattern that suggests Foxconn’s security posture may be inconsistently applied across its 24-country, 900,000-employee footprint.

A wrinkle worth knowing: paying may not even work

Nitrogen has been active since 2023, originally as an initial-access broker feeding the BlackCat/ALPHV ransomware operation, and is believed to be one of several groups that borrowed code from the leaked Conti 2 builder. Researchers at Coveware found a programming error in Nitrogen’s decryptor for VMware ESXi environments — meaning victims who pay the ransom may not be able to recover their files anyway. That makes backups and prevention more important than negotiation.

There’s also reason for healthy skepticism about the claimed scope. Halcyon’s Ransomware Research Center noted that Nitrogen’s leak-site claims did not include a working file listing, and that many of the sample images posted appeared to be older material — a reminder that ransomware groups routinely inflate their haul for leverage.

Why it matters

Foxconn sits underneath a huge share of global consumer electronics production. A breach at one contract manufacturer becomes a potential exposure event for half a dozen trillion-dollar brands downstream — without attackers ever touching those companies’ own networks.

Key takeaways for manufacturers and their partners: - Repeated targeting of the same organization is a sign of inconsistent security investment across regions, not just bad luck. - Verify decryptor reliability claims before assuming a ransom payment guarantees recovery — some tools are simply broken. - Treat every tier-1 supplier relationship as an extension of your own attack surface.

Sources: The Register, Cybersecurity Magazine, Rescana threat analysis, and Foxconn’s public statements.