Foxconn subsidiary suffers 5TB data leak; chip industry remains key target for ransomware gangs

Foxsemicon Integrated Technology, a subsidiary of Taiwanese electronics giant Foxconn, appears to have become a target of the notorious LockBit ransomware gang.

Foxsemicon specialises in semiconductor equipment manufacturing. Last week, the company's website was defaced, and hackers posted a threatening message on Foxsemicon's website saying they had stolen customers' personal data and would publish it on their dark web site if the company refused to pay.

Keep in mind that once your data is on our leak site, it can be bought by your competitors at any time, so do not hesitate for a long time.

The hackers claim to have accessed 5TB of the company's data.

The tactics they used in attacking Foxsemicon are atypical for LockBit, who usually choose to publish victims' names on a ransom site rather than defacing target companies' web pages directly. But ransomware gangs are known to try various tactics to increase their chances of getting paid.

The hackers' message told employees they would lose their jobs because they allegedly "have the ability to completely destroy Foxsemicon with no recovery." It is not uncommon for ransomware gangs to exaggerate their claims to put greater pressure on victims.

The ransomware gang also advised the company against contacting any ransomware recovery services or insurance companies. The exact ransom amount is not known, but this part of the message did mention a USD 1 million ransom as an example.

Taiwanese media reported on Wednesday that Foxsemicon, in a filing with the Taiwan Stock Exchange, said it restored its website shortly after detecting the attack and is currently working with security experts.

In the statement, it said a preliminary investigation showed the incident "would not have a significant impact on the company's operations."

However, as of the afternoon of 17 January EST, the company's website was inaccessible, while search results still displayed the hackers' message. The company's stock price fell about 3% on the Taiwan market that day.

The ransomware gang did not mention its own name on the defaced Foxsemicon website, but links provided to the company pointed to the LockBit Tor-based dark web site.

Foxsemicon has not yet been listed on the LockBit website. The gang has been carrying out some of the largest and most active ransomware attacks globally, and last year, the gang also targeted several other semiconductor companies, including TSMC, initially demanding a USD 70 million ransom from the company.

LockBit has now launched several attacks against various industries, and the semiconductor industry, as a critical industry in today's IT-driven global economy, has long been a primary target for ransomware gangs. Whether driven by pure financial incentives or at the heart of geopolitical competition, cyberattacks and industrial espionage against semiconductor companies are bound to continue.

Security validation users can filter LockBit and other ransomware gang-related attack techniques in the Security Metric Validation Platform to validate with one click whether your security defense system can effectively defend against these attacks. The platform ensures your validation process is safe and harmless in a unique industry way.