Desk live·
ForensicPost
Ransomware/Manufacturing/File 26-0512

Eight Terabytes, Claimed, From the Factory Floor of Everything

The Nitrogen group claimed 8 TB from Foxconn in May 2026, describing customer schematics among the material. We publish the claim, label it a claim, and explain why we are not printing the customer list.

Constructed geometry · not a chart of case data
TargetFoxconn
ActorNitrogen
S. Rosler8 min readConfidence: low1 source reviewed

In May 2026 the Nitrogen group claimed an intrusion at Foxconn and described roughly 8 terabytes of data, including schematics associated with named technology customers. That is the whole of what is established: a group said this.

We are publishing the file anyway, because a claim against a manufacturer of that significance is itself newsworthy, and because readers are better served by a clearly graded low-confidence entry than by silence followed by a rumour.

Why The Customer Names Stay Out

The temptation in a listing like this is to lead with the recognisable brands the group mentions. Naming them would convert an unverified assertion into an apparent finding about companies that have not been shown to be affected, and that have no practical way to disprove it.

A leak-site listing is an advertisement. Its author selects the details most likely to generate attention, and recognisable customer names are the most reliable way to do that. Reproducing the selection reproduces the marketing.

What would move this file to medium: a sample verified against an independent record, a statement from the company, or a named customer confirming its material was included. None of those exists yet.

How we reported this

Compiled from public reporting, listed below. Every figure in this file originates with the attacking group. We did not review the listed data, and we are not naming the customers the group named. Corrections: corrections@forensicpost.com.

Sources
  1. List of recent data breaches in 2026Bright Defense
S. Rosler
Covers extortion groups and leak-site economics. Verifies our sample sets.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary