GoKawiilAn apparent ransomware attack on several of Foxconn's North American facilities is the latest reminder that manufacturing companies are among the most targeted in cybercrime, because of their central role in high-value supply chains and low-tolerance for downtime.
Foxconn this week admitted that a cyberattack had affected operations at some of its North American facilities. In a brief statement to Dark Reading, the world's largest contract electronics manufacturer stopped short of describing the attack as a ransomware incident, and did not disclose the scope or the impact of the breach, but confirmed that a malicious actor was behind the incident.
Nitrogen Ransomware Gang Claims Credit for Breach
"Some of Foxconn's factories in North America suffered a cyberattack," said the company, whose clients include Apple, Nvidia, Amazon, Dell, Google, Huawei, Microsoft, Nintendo, Sony, and Xiaomi. "The cybersecurity team immediately activated the response mechanism and implemented multiple operational measures to ensure the continuity of production and delivery. The affected factories are currently resuming normal production."
Related:China's 'FamousSparrow' APT Nests in South Caucasus Energy Firm
Earlier this week, ransomware group Nitrogen claimed credit for the attack on its leak site, according to threat intelligence firm Hackmanac. The threat actor claimed it had exfiltrated more than 11 million files, amounting to some 8TBs of data, from Foxconn, Hackmanac said. The stolen data allegedly included "confidential instructions, internal project documentation, and technical drawings related to projects involving Intel, Apple, Google, Dell, Nvidia, and other companies," Hackmanac said.
Sofia Scozzari, CEO and founder of Hackmanac, tells Dark Reading that the sample files that Nitrogen uploaded to its leak site allegedly included Foxconn financial records, engineering schematics, motherboard and PCB diagrams, server platform documentation, power distribution guidelines, thermal and liquid leakage sensor designs, I3C/I2C topology specifications, and manufacturing process documents.
"The exposed materials also reference confidential technical documentation associated with JPMorgan Chase, Google, Intel, NVIDIA, AMD, ASPEED, Renesas, Hewlett Packard Enterprise, and Tencent," Scozzari says. At this stage, there is no confirmation that Foxconn paid a ransom, she says. "However, the company is still listed on the Nitrogen ransomware group's onion leak site, which suggests that either negotiations are ongoing, or the company has decided not to pay the ransom."
Related:Tech Can't Stop These Threats — Your People Can
Manufacturers: A Prime Target for Ransomware
... continue reading