Nucor Shuts Down Production at Multiple Facilities Following Cyberattack

Nucor Corporation, the largest steel producer in North America, disclosed a material cybersecurity incident on May 13, 2025, prompting it to halt certain production operations across multiple locations as a precautionary measure.

According to the company’s Form 8-K filing with the U.S. Securities and Exchange Commission, the breach involved unauthorized access by an external threat actor to parts of Nucor's IT infrastructure. Upon detection, Nucor activated its incident response plan, shut down potentially affected systems, and brought in external cybersecurity experts to investigate and contain the situation. Federal law enforcement agencies have also been notified and are involved in the ongoing response.

The filing, signed by Nucor’s CFO, emphasizes that while the company is still evaluating the full scope of the incident, some production sites were taken offline temporarily “in an abundance of caution.” Operations at affected facilities are reportedly in the process of being restored as of the filing date.

Founded in 1940 and headquartered in Charlotte, North Carolina, Nucor operates dozens of steel mills and fabrication facilities across the United States. The company is a key player in the construction, automotive, energy, and infrastructure sectors, making any disruption to its production capacity particularly impactful to downstream industries.

The disclosure did not include details on the specific systems or data affected, nor did it attribute the incident to any known threat group. However, the seriousness of the response — including the involvement of law enforcement and third-party cyber firms — suggests that the breach could have involved operational technology (OT) environments, not just standard IT systems. As of this writing, no ransomware groups have claimed responsibility or listed Nucor on their extortion sites.

While Nucor did not confirm whether any data was exfiltrated, the company acknowledged potential risks stemming from the breach, including reputational damage, customer and regulator impact, and future litigation or regulatory scrutiny.