Cybersecurity Breach: Nucor Faces Major IT Network Disruption

At a glance

• Nucor Corp., the largest steelmaker in North America, has disclosed a cybersecurity incident affecting its IT network.
• The company halted some production while it took affected systems offline.
• Nucor is working with outside experts and law enforcement to restore operations.

What Nucor disclosed

Nucor Corp., the biggest steel producer in the United States, is the latest large company to report a cyberattack. Manufacturers are attractive targets. Every hour a mill sits idle costs money, and attackers know that pressure can push companies toward paying.

How the incident unfolded

On May 14, 2025, Nucor said in a filing with the Securities and Exchange Commission that it had detected unauthorized third-party access to some of its IT systems. It took the systems it believed were affected offline. Production stopped at some sites. It brought in outside cybersecurity experts and notified law enforcement.

How serious it is

Nucor did not say at first what data, if any, was taken. It said it was working with security experts to find out how far the intruders got. In a later filing, the company said limited data had been taken out of its systems and that it believed the attacker no longer had access.

The lesson for manufacturers

The incident shows how exposed heavy industry has become. Steel mills depend on IT systems for scheduling and shipping, and many plant controls are tied to the same network in ways that only become obvious when something breaks. When those systems go down, production can stop.

Industry reaction

Other manufacturers are watching how Nucor handles the recovery. Security specialists are recommending end-to-end encryption and regular audits. Staff training helps too.

Containment and restart

Nucor moved quickly to contain the intrusion and restart operations. Its prompt public disclosure kept customers and investors informed while the investigation was under way.

Hardening the network

Beyond the immediate recovery, Nucor said it is strengthening its IT infrastructure, including new security tools and more staff training.

What to check at your plant

Nucor’s halt shows that an IT intrusion can stop physical output even when plant equipment is not directly attacked. Manufacturers should know which production steps depend on IT systems, how long they can run without them, and how quickly they can isolate the corporate network from the plant floor. Those answers are easier to find before an incident than during one.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.