Steel Giant Nucor Halts Production Amid Cybersecurity Breach Chaos

At a glance

• What happened: Nucor Corporation detected unauthorized access to its IT systems and temporarily halted production at some sites.
• Impact: North America’s largest steel manufacturer had to pause parts of its operations, raising questions about security across heavy industry.
• Response: Nucor began an investigation, brought in outside experts and notified law enforcement.
• Industry stakes: Manufacturers depend on IT systems that attackers can disable.

What Nucor disclosed

Nucor Corporation, the largest steel producer in North America, disclosed in an SEC filing on May 14, 2025 that an unauthorized third party had accessed some of its IT systems. The company took affected systems offline and temporarily halted certain production operations at various locations.

Nucor said it brought in outside cybersecurity experts and notified law enforcement. It did not say at first who was behind the attack or what data was affected. It did say it was working to restart production.

Effects on customers

Nucor’s customers felt the pause. Its steel goes into cars, buildings and equipment, and delayed shipments can push costs down the supply chain. How much depends on how long each mill was down.

The incident adds to a long list of attacks on manufacturers. Production stops when IT systems stop. Attackers know that pressure can push a company toward a quick payment.

Nucor’s investigation

Nucor launched an investigation into how far the intruders got and worked with security experts to secure its systems while keeping disruption for customers to a minimum.

In a June 2025 update, Nucor said the affected production and IT applications had been restored, that limited data had been taken from its systems and that it believed the attacker no longer had access.

Why heavy industry is exposed

Manufacturers are digitizing and automating at a fast pace. Every connected scheduling system, plant controller and supplier portal adds a way in. Plant IT is often decades old and hard to patch without stopping production.

That makes recovery planning as important as prevention. Plants need to know which steps can run without IT, and for how long.

What manufacturers should check

Nucor’s incident shows that an attack on business systems can halt physical output even when the furnaces themselves are not touched.

Manufacturers should map which production steps depend on corporate IT, practice isolating plant networks quickly and keep offline copies of the data needed to restart.

Those steps are cheap compared with a week of idle mills.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.