Nucor halts steel production at multiple sites after cyberattack

Nucor Corporation, the largest steel producer in North America, disclosed in a filing with the U.S. Securities and Exchange Commission on 14 May 2025 that an unauthorised third party had accessed portions of its information technology systems.

The Charlotte, North Carolina company said it had proactively taken potentially affected systems offline and had temporarily halted certain production operations at various locations while it assessed the intrusion. Cybersecurity Dive reported that the systems were pulled offline on 13 May, the day before the filing. Nucor did not identify which mills were affected.

Nucor said it had begun containment, remediation and recovery work, notified federal law enforcement and engaged outside cybersecurity specialists to help with the investigation. By the time of the filing the company said it was in the process of restarting the affected operations, though it gave no timeline for a full return to normal output and said it had yet to determine whether the incident would be material.

The company did not describe the nature of the attack or name a perpetrator, and no ransomware group publicly claimed the intrusion in the days that followed. Nucor accounts for roughly a quarter of U.S. raw steel production and operates more than 20 steel mills alongside fabrication plants and about 70 recycling centres.