In May 2025 an intruder in Nucor's IT systems led North America's largest steel producer to halt production at various locations as a precaution. Nucor filed it as not material. No vector, actor or incident cost is on the record.
Nothing in Nucor's record says a furnace, a caster or a control system was reached. Both filings describe information technology, and production halted at various locations anyway. Nucor acted well: it filed the day after its date of report, before it knew the scale, stopped its own lines rather than wait, restored from backups, and came back five weeks later to disclose that data had left.
The finding is not that it stopped. It is that stopping was the defensible answer. When the only move an operator can prove safe is to halt the mills, the plant was already riding on the business network. That is BlastWave's analysis, not a disclosed fact. The correction is ours: our first volume gave this incident ransomware, a loss range, a downtime figure and a likely vector. None of it is in either filing.
What is not known: Nucor has not said how the intruder got in, who it was, what tooling it used, which facilities stopped or for how long. Its amendment sets limited access to IT applications supporting some operations beside a production halt made in an abundance of caution, without saying which stopped which line. No filing names ransomware or any malware. Nucor told the SEC the incident was not material and filed no cost; class action papers describe the stolen data as personal information of about 3,000 people. Whether any plant could have run without those systems is not on the record.
Recommendation
Take the path away Scheduling, recipes and order release the mill needs belong on the plant side of a boundary, so containing IT is a decision about IT, not a decision to stop steel.
Remove standing credential access Every remote and vendor path into plant networks is tied to a named person, scoped and revocable in one move, so containment is a policy change, not a shutdown.
Make the business side read one way The office sees the mill without being able to reach back into it, and the plant keeps a rehearsed way to run a shift while the office is dark.
Sources: Form 8-K, Item 1.05, 14 May 2025; Form 8-K/A, Item 1.05, 20 Jun 2025; EDGAR full-text search, CIK 0000073309, 24 Sep 2026; Sweat v. Nucor, W.D.N.C. 3:25-cv-00478, settlement approved 18 Aug 2026. Full list with links.
Soft Spots: That a precautionary halt shows the plants depended on business systems, or that nobody could prove they did not, is BlastWave's analysis. “Not material” is Nucor's judgement, not a statement of zero cost.
The full record
Every claim numbered to its source. Last updated .
An intrusion its filings place in IT, a production halt Nucor made in an abundance of caution, and an incident it told the SEC was not material. What is verified, what is only reported, and what is still unknown.
Summary
In May 2025, Nucor, North America's largest steel producer, reported unauthorized access to certain information technology systems and halted production at various locations "in an abundance of caution." In June it said a threat actor had exfiltrated limited data, operations were restored, and the incident was not material. No vector, attacker, malware or incident cost has been disclosed.1,2
Timeline of the Nucor incident
Every date is tied to a source. Press reporting appears only as evidence of what was said.
An unauthorized third party has access to Nucor's environment. Nucor's counsel later told the New Hampshire attorney general that in this window it "accessed and acquired certain data stored in the Nucor environment."3,4
Nucor identifies the incident, on approximately 13 May per the settlement agreement and its state notice. 13 May is also the date of report on its 8-K.1,3,4
Nucor files a Form 8-K under Item 1.05: unauthorized third party access to certain IT systems, potentially affected systems taken offline, and certain production operations at various locations halted "in an abundance of caution." Restarting is under way.1
Nucor files an amended 8-K: a threat actor illegally accessed its IT systems and exfiltrated "limited data"; affected data restored from backups; operations restored; the incident not material and not reasonably likely to be.2
BleepingComputer reports that "no ransomware operations have claimed responsibility."7
Nucor mails breach notices to affected people, offering 24 months of credit monitoring.3,4
Nucor's counsel, Moore & Van Allen, writes to the New Hampshire attorney general (received 30 June).4
A data breach class action, Sweat v. Nucor Corporation, is filed in the Western District of North Carolina.3
Nucor files its Form 10-K for fiscal 2025. None of the amendment's incident phrases appear in it.5,6
The court gives final approval to the class action settlement, with Nucor denying liability.3
EDGAR full-text search finds "cybersecurity" in none of the five Nucor 10-Qs filed since May 2025; a control term appears in all five.5
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
What systems were reached?
"Certain information technology systems used by the Company"1,2
Verified
Were plants or control systems reached?
No filing says so. Both describe IT only; none describes any effect on a furnace, caster, mill or control system1,2
Verified (the filings' scope; silence, not proof)
Who stopped production?
Nucor itself, "temporarily and proactively," "in an abundance of caution"1
Verified
Which sites, and for how long?
"Various locations"; no count, names or duration. Restored by 20 June 20251,2
Undisclosed
Was it ransomware?
Neither filing says ransomware, encryption or malware1,2
Undisclosed
Who was the attacker?
"A threat actor." No government attribution; no claim of responsibility found2,7
Undisclosed
How did the intruder get in?
Not stated in any filing or government document1,2
Undisclosed
Access window
3 to 13 May 2025, per Nucor's notice letter and its counsel's state filing3,4
Personal information (names, dates of birth, Social Security and driver's license numbers) of about 3,000 notified people3
Verified (court record)
Incident cost
No figure filed. Nucor: not material, and not reasonably likely to be2
Undisclosed
Class action
Settled: claims capped at $200,000, $100,000 attorneys' fees, final approval 18 August 2026, no admission of liability. Not the cost of the incident3
Verified (court record)
Were Nucor's steel mills or control systems hacked?
Nothing on the record says so: both of Nucor's filings describe information technology, and nothing else. The 8-K of 14 May 2025 reports unauthorized third party access to "certain information technology systems used by the Company" and potentially affected systems taken offline.1 The amendment of 20 June 2025 says a threat actor illegally accessed the company's information technology systems.2
No filing describes production or control systems being reached, and none describes any effect on a furnace, a caster, a mill or a control system.1,2 That is a statement about the record's silence, not a finding that no plant system was touched. On the consequence ladder this volume uses, the entry sits as an IT compromise that halted physical operations, with no OT compromise on the record.
Why did Nucor halt steel production?
Nucor says it halted production itself, as a precaution; its amendment also describes limited access to IT applications, and never says which condition stopped which line. The 8-K said that, in an abundance of caution, the company had "temporarily and proactively halted certain production operations at various locations" and was restarting them.1 Five weeks later the amendment set a second condition beside that one:
"a temporary limitation of access to portions of the Company's information technology applications supporting some aspects of the Company's operations at some of the Company's facilities."
The two conditions sit side by side in the same filing. Nothing in the record merges them into one cause, in either direction, and nothing says which facilities stopped or for how long. Nucor restored "affected data from backup systems," and reported operations and the necessary applications restored by 20 June 2025.2
What data was stolen in the Nucor breach?
Personal information, not production data. The amendment says only that the threat actor exfiltrated "limited data" and that Nucor was reviewing it and would notify as required.2
Nucor's later notices fill in the rest. Its counsel's letter to the New Hampshire attorney general, dated 27 June 2025, says the investigation found that between 3 and 13 May 2025 "an unauthorized third party accessed and acquired certain data stored in the Nucor environment." The data review finished on approximately 16 June; for the one New Hampshire resident involved, the data were a Social Security number, a corporate credit card number and a date of birth. Notices were mailed on 24 June, with 24 months of credit monitoring offered.4
The class action record describes the data more broadly: names, dates of birth, Social Security and driver's license numbers of about 3,000 people to whom Nucor sent notice. The 3,000 figure comes from the plaintiffs' unopposed motion; the data types from the settlement papers.3
How much did the Nucor cyber incident cost?
No cost has been disclosed. The only word Nucor gave the SEC about money is that the incident was not material.
"has not had a material impact, and is not reasonably likely to have a material impact"
Not material is Nucor's judgment, about a company of Nucor's size. It is not a statement that the incident cost nothing, and it is not a statement that nothing physical happened: production halted at various locations. Nucor filed both the 8-K and the amendment under Item 1.05, the item for material cybersecurity incidents, including the filing that says not material.1,2
The data breach class action is court record, not an incident cost: claims capped at $200,000 in aggregate, $100,000 in attorneys' fees, final approval on 18 August 2026, and no admission of liability.3
Which condition stopped which line: the limited access to IT applications or the precautionary halt.2
The cost of the incident. Nucor filed no figure and called it not material.2
Whether any plant could have run without the affected systems.
Whether the fiscal 2025 10-K refers to the incident in words other than the amendment's.6
What, if anything, was said about the incident on Nucor's earnings calls. Transcripts are not filings and were not reviewed.
Claims about Nucor the record does not support
Widely repeated claim
What the record says
"Unknown Ransomware"
Neither filing uses the words ransomware, encryption or malware. Restoring data from backups is consistent with several kinds of incident and confirms none.1,2,8
"~$20M-50M in losses"
Nucor filed no dollar figure. Its only word to the SEC about money is that the incident was not material, and not reasonably likely to be.2,8
"~1-3 days downtime at several mills"
No duration and no count of sites is on the record: "certain production operations at various locations," restored by 20 June 2025.1,2,8
"Likely unpatched Citrix Gateways or phishing"
No filing, statement or government document gives a vector.1,2,8
"Weak Credentials, Lack of Segmentation"
Nucor describes response and remediation, not cause. The root cause is undisclosed.1,2,8
"Nucor had to shut down OT."
Both filings describe IT systems only. Nucor described the halt as proactive and made "in an abundance of caution"; "had to" turns a choice into a compulsion.1,2,8
Including our own. Every claim in the table above was printed by us. Our Volume 1 Hackopedia page labeled this incident "Unknown Ransomware," estimated "~$20M-50M in losses, ~1-3 days downtime at several mills," gave "Likely unpatched Citrix Gateways or phishing" as the vector and "Weak Credentials, Lack of Segmentation" as the root cause, and said Nucor "had to shut down OT." None of it is in any Nucor filing. We printed a range where the company printed a word, and the range was ours. All of it is corrected here.8 We correct our own record first; it is what earns the right to correct anyone else's.
Has Nucor said anything about the incident since June 2025?
Not in its SEC filings. An EDGAR full-text search of Nucor's filings from 1 May 2025 to 24 September 2026 finds "cybersecurity" in five documents: the 8-K, the amendment, the Form 10-K for fiscal 2025, the 2026 annual report to shareholders and the 2026 proxy statement. It appears in none of the five quarterly reports on Form 10-Q in that window. As a control, "steel mills" appears in all five. "Threat actor" and "exfiltrated" each appear in exactly one filing, the amendment.5
The fiscal 2025 10-K, filed 25 February 2026, carries prospective risk language on cyberattacks; none of the amendment's incident phrases appear in it. Whether it refers to the incident in other words has not been confirmed.5,6
Outside the SEC, the trail continued: Nucor sent breach notices to affected people and to at least one state attorney general, and settled the class action.3,4 "Never reopened" is true only of its SEC filings.
BlastWave analysis: caution is the outage
Analysis, not a disclosed fact
Nucor acted well. It filed the day after the date of its report, before it knew the scale, stopped its own lines rather than wait, restored from backups, and came back five weeks later to disclose that data had left.1,2 The finding is not that it stopped. It is that stopping was the defensible answer.
When the only move an operator can prove safe is to halt the mills, the plant was already riding on the business network, or nobody could prove it was not. That is BlastWave's analysis, not a disclosed fact: neither filing describes how Nucor's plants and its IT connect. Whether Nucor had a way to run a shift without those systems is the question its record leaves open, and the one every reader can put to their own plant.
Podcast: “The Fireworks Hold” (9:06). Joe Baxter and Cam Cullen on why stopping the mills was the right call, and why needing to stop them is the finding.
Video: Nucor Short (60 to 90 seconds).
Frequently asked questions
What happened in the Nucor cyberattack?
On 14 May 2025 Nucor, North America's largest steel producer, told the SEC it had found unauthorized third party access to certain information technology systems, taken potentially affected systems offline, and, in an abundance of caution, halted certain production operations at various locations. In an amended filing on 20 June 2025 it said a threat actor had exfiltrated limited data, operations were restored, and the incident was not material.
Were Nucor's steel mills or control systems hacked?
Nothing on the record says so. Both of Nucor's SEC filings, of 14 May and 20 June 2025, describe information technology systems only, and no filing describes any effect on a furnace, caster, mill or control system. Nucor says it halted certain production operations in an abundance of caution; its amendment also describes a temporary limitation of access to IT applications, without saying which stopped which line. That is the record's silence, not proof that no plant system was touched.
Was the Nucor incident ransomware?
Not in its filings on the incident. Neither its 8-K of 14 May 2025 nor its amendment of 20 June 2025 uses the words ransomware, encryption or malware. The amendment says Nucor restored affected data from backup systems, which is consistent with several kinds of incident and confirms none. BleepingComputer reported on 23 June 2025 that no ransomware operation had claimed responsibility.
Who was behind the Nucor breach?
Nucor's amendment of 20 June 2025 names only a threat actor. No government has attributed the incident, and no claim of responsibility was found in any source reviewed as of late September 2026. How the intruder got in has also not been disclosed in any filing, statement or government document.
What data was stolen from Nucor?
Nucor's June 2025 amendment says the threat actor exfiltrated limited data. Settlement papers in the class action Sweat v. Nucor Corporation describe names, dates of birth, Social Security and driver's license numbers of about 3,000 people Nucor notified. Nucor's notice to the New Hampshire attorney general, dated 27 June 2025, says the data was accessed and acquired between 3 and 13 May 2025.
How much did the Nucor cyber incident cost?
No cost has been disclosed. Nucor's amended 8-K of 20 June 2025 says the incident has not had a material impact and is not reasonably likely to have one. That is Nucor's judgment about a company of its size, not a statement of zero cost. A related data breach class action settled with claims capped at $200,000 and final approval on 18 August 2026, which is not the cost of the incident.
How long were Nucor's plants down?
Nucor has not said. Its 8-K of 14 May 2025 said certain production operations at various locations were halted and restarting was under way, and its amendment of 20 June 2025 said operations had been restored. No filing names the facilities, counts them, or gives a duration, and estimates of days of downtime are not supported by any Nucor filing.
Primary sources are Nucor's own SEC filings and breach notice, the federal court record of the data breach class action, and EDGAR searches of Nucor's filings. Press is cited only as evidence of what was said.
Company filingNucor Corporation, Form 8-K, Item 1.05 (Material Cybersecurity Incidents), date of report 13 May 2025, filed 14 May 2025, accession 0001193125-25-119311. Signed by Stephen D. Laxton, Chief Financial Officer. sec.gov
Company filingNucor Corporation, Form 8-K/A (Amendment No. 1), Item 1.05, filed 20 June 2025, accession 0001193125-25-143135. sec.gov
Court recordSweat v. Nucor Corporation, No. 3:25-cv-00478 (W.D.N.C.): Class Action Complaint, filed 2 July 2025 (quoting Nucor's notice letter of 24 June 2025); Settlement Agreement and Release; plaintiffs' memorandum in support of preliminary approval; Final Approval Order, 18 August 2026. Published on the settlement website.
Company filingMoore & Van Allen for Nucor Corporation, security breach notification letter to the New Hampshire Attorney General, Consumer Protection and Antitrust Bureau, dated 27 June 2025, received 30 June 2025. PDF
RegulatorSEC EDGAR full-text search of Nucor Corporation filings (CIK 0000073309), run 24 September 2026 and re-run 28 September 2026; and EDGAR company record (SIC 3312).
Company filingNucor Corporation, Form 10-K for the fiscal year ended 31 December 2025, filed 25 February 2026, accession 0001193125-26-071575. sec.gov
PressBleepingComputer, "Steel giant Nucor confirms hackers stole data in recent breach," 23 June 2025. Cited as evidence of what was said. bleepingcomputer.com
CompanyBlastWave, Hackopedia Volume 1, "Nucor Proactive Shutdown (2025)," entry and summary table. Cited as the error corrected. hackopedia.blastwave.com
Cite this page
BlastWave. “Nucor Cyber Incident and Production Halt (2025): What Is Verified.” Hackopedia, Volume 2, FILE 016. Last verified 2 October 2026. https://hackopedia.blastwave.com/manufacturing/nucor-2025/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 016 in Hackopedia Volume 2, in the Manufacturing edition.
2 Oct 2026
Nucor's breach notification to the New Hampshire Attorney General (27 June 2025) read at source. The 3 to 13 May 2025 access window now rests on Nucor's own account as well as the class action record.
28 Sep 2026
Hand-check at source: the EDGAR full-text search counts re-run and confirmed, and the filing date of the fiscal 2025 10-K confirmed. The page was checked against related entries.
26 Sep 2026
Full validation: both filings' Item 1.05 text re-read at the SEC. The class action court record was added. The discovery date, previously given as undisclosed, now reads identified on approximately 13 May 2025; the stolen data is now described from the court record; and statements that Nucor never reopened the incident, or that its only word about money was not material, were narrowed to its SEC filings.
24 Sep 2026
Volume 2 entry built from Nucor's SEC filings. Corrected Volume 1 errors: the ransomware label, the loss estimate, the downtime estimate, the vector, the root cause and the statement that Nucor had to shut down OT.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
North America
19
Print edition · Volume 2File 016 as a printable pageThe same record, laid out for print: one page, US Letter, PDF.Download PDF · 247 KB