Nucor Corporation
Nucor Corporation cyber incident
Summary
Unauthorized IT access led Nucor to take systems offline and temporarily halt some production operations at multiple locations in May 2025. By June 20, the company reported restoration of affected production and necessary applications and confirmed limited data theft. The intruder and any ransomware involvement remain unresolved.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted location
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data theft or exfiltration
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Manufacturing or production disruption
Manufacturing, production, assembly, processing, or industrial operations were reduced, stopped, or impaired.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Nucor Corporation’s May 2025 cyberattack interrupted some production operations after unauthorized access to its information technology systems. We reported the shutdowns following the company’s initial SEC disclosure. DysruptionHub assesses the cyberattack and resulting operational disruption with high confidence. The reviewed evidence does not establish ransomware encryption or identify the intruder.
A later court-authorized settlement notice identifies May 3–13, 2025, as the period of unauthorized access and data acquisition, with discovery around May 13. May 3 is the earliest supported incident activity; the May 14 SEC filing is the earliest verified public disclosure reviewed here.
Operational significance
Nucor took potentially affected systems offline and temporarily halted certain production operations at multiple locations as a precaution. Its May 14 filing said restarting was underway. The company did not identify the facilities or establish that every location stopped operating.
A June 20 amendment confirmed temporary restrictions on applications supporting operations at some facilities. By that filing, affected production and access to necessary applications had been restored. Nucor also described restoring affected data from backups and said it believed the intruder no longer had access.
The operational incident is resolved, although the filings do not provide an exact final restoration day. Nucor’s assessment that the incident had not materially affected its business or financial results does not negate the documented production interruption.
Confidence and uncertainty
The June amendment confirmed limited data exfiltration. The settlement notice subsequently described personal information in the affected files, a review completed around June 16 and written notifications beginning around June 24, 2025. Those later steps do not establish a continuing production outage. The reviewed material does not establish a complete affected population or which information categories applied to each person.
In Sweat v. Nucor Corporation, the federal court’s Aug. 18, 2026, order granted final approval of the settlement and dismissed the action with prejudice. Nucor denied wrongdoing and liability; the settlement is not an admission. This litigation concerns the May 2025 incident.
Analytic gaps
The reviewed sources do not establish an initial access method, exploited vulnerability, ransomware group, ransom demand or payment outcome. No matching listing was identified in the reviewed ransomware lead searches. Specific affected plants, the duration of each production halt and any compromise of industrial-control systems remain unverified.
Organizations involved
Impacted location
Charlotte, North Carolina
Charlotte anchors the affected company’s headquarters. Nucor did not identify the affected production facilities; this place association does not establish that a Charlotte steel plant stopped operating.
Sources
Document 28 grants final approval of the May 2025 incident settlement and dismisses the case with prejudice.
The notice identifies May 3–13, 2025 unauthorized access and acquisition, discovery around May 13 and later personal-information notifications.
See something that needs correction?
Signed-in members can report an error, update, or missing source.