Nucor Steel Confirms Data Theft Following May 2025 Cyberattack

Nucor Corporation, North America’s largest steel producer, confirmed in a June 23 SEC filing that attackers exfiltrated data during a May 2025 cybersecurity incident that disrupted operations across 300+ facilities. While production systems were restored by June, the confirmation of data theft raises new concerns about the attack’s scope and potential long-term implications¹.

Incident Timeline and Impact

The breach began on May 14, 2025, when Nucor detected unauthorized access to IT systems, forcing temporary shutdowns at manufacturing sites across the U.S., Canada, and Mexico². Initial reports indicated operational disruptions but no confirmed data compromise. The June 23 update revealed that forensic investigations identified limited data exfiltration, though the company has not disclosed specific data types affected³.

Nucor’s swift containment measures prevented material financial impact, with Q1 2025 revenues reported at $7.83 billion. The company maintains 25% U.S. market share despite the incident⁴. This contrasts with previous attacks on critical infrastructure like Colonial Pipeline (2021), where operational halts caused widespread supply chain disruptions.

Technical and Operational Response

Nucor engaged the FBI, CISA, and third-party cybersecurity experts during the investigation⁵. The absence of ransomware claims has led some analysts to speculate about potential nation-state involvement, though no attribution has been confirmed⁶. The company’s transparency in SEC filings and collaboration with authorities has been noted as a positive aspect of its response.

Manufacturing systems often face unique security challenges, including legacy equipment and complex supply chain integrations. IBM’s 2025 X-Force Report identifies manufacturing as the most targeted sector, with attacks frequently exploiting outdated network architectures⁷. Nucor’s incident highlights these persistent vulnerabilities despite industry awareness.

Unresolved Questions and Industry Implications

Key unknowns include the type of stolen data and whether attackers gained access to proprietary manufacturing processes or employee/customer information. The lack of ransomware demands suggests possible espionage motives, though definitive conclusions await further investigation⁸.

The attack reinforces the need for asset-intensive industries to prioritize network segmentation and real-time monitoring. Nucor’s ability to restore operations within weeks demonstrates the value of incident response planning, but the data theft confirmation shows that operational recovery alone doesn’t equate to full security resolution.