8-K/A: Nucor Corporation Confirms Cybersecurity Incident Contained, No Material Impact on Operations or Financials

Nucor Corporation filed an amended 8-K report providing supplemental information on a recent cybersecurity incident, confirming that affected operations have been restored and there is no material impact on its business or financial condition.

Summary

• Nucor Corporation filed an Amendment No. 1 to its Current Report on Form 8-K, originally filed on May 14, 2025, to provide supplemental information regarding a cybersecurity incident.
• The company's investigation revealed that a threat actor illegally accessed its information technology systems.
• The incident led to a temporary limitation of access to certain IT applications supporting some operations at various facilities, and Nucor proactively halted some production operations as a precaution.
• Limited data was exfiltrated from the company's IT systems, and Nucor is reviewing this data to carry out necessary notifications to affected parties and regulatory agencies.
• Upon detection, Nucor immediately activated its incident response plan, took affected systems offline, restored data from backups, and implemented containment and recovery measures.
• The company engaged leading external cybersecurity experts and notified federal law enforcement authorities.
• Since the original filing, affected production operations and access to necessary IT applications have been restored.
• Nucor believes the threat actor no longer has access to its systems and has reinforced its IT infrastructure to prevent future unauthorized access.
• The company asserts that the cybersecurity incident has not had, and is not reasonably likely to have, a material impact on its business operations, financial condition, or results of operations.

Sentiment

Score: 8

Explanation: While a cybersecurity incident is inherently negative, Nucor's swift and effective response, successful remediation, and explicit statement of no material impact on operations or financials indicate a strong recovery and positive outlook regarding the incident's resolution, mitigating potential negative sentiment.

Positives

• Affected production operations and access to necessary information technology applications have been restored.
• Nucor believes the threat actor no longer has access to its information technology systems.
• The company has further reinforced its information technology systems to prevent future unauthorized access.
• The cybersecurity incident has not had, and is not reasonably likely to have, a material impact on Nucor's business operations, financial condition, or results of operations.

Negatives

• A cybersecurity incident occurred involving illegal access by a threat actor to Nucor's information technology systems.
• The incident resulted in a temporary limitation of access to portions of IT applications and a proactive halt of certain production operations at various locations.
• Limited data was exfiltrated from the company's information technology systems.

Risks

• The company's ongoing assessment of the impacts of the cybersecurity incident, including the potential discovery of additional information related to the incident.
• The potential impact of the cybersecurity incident on Nucor's relationships with customers, employees, and governmental regulators.
• Legal, reputational, and financial risks resulting from the cybersecurity incident, including potential regulatory inquiries and/or litigation.
• Remediation and other additional costs that may be incurred by the company in connection with the investigation and remediation of the incident.
• General risks discussed in Item 1A. Risk Factors of the Company's Annual Report on Form 10-K for the year ended December 31, 2024, and subsequent Quarterly Reports on Form 10-Q.

Future Outlook

Nucor expects to continue its assessment of the impacts of the cybersecurity incident, including the potential discovery of additional information. The company believes it has successfully contained and remediated the incident, with the threat actor no longer having access to its systems. Importantly, Nucor does not anticipate a material impact on its business operations, financial condition, or results of operations from this incident.

Management Comments

• "The Company believes that the threat actor no longer has access to the Companys information technology systems."
• "The cybersecurity incident has not had a material impact, and is not reasonably likely to have a material impact, on the Companys business operations, and has not had a material impact, and is not reasonably likely to have a material impact, on the Companys financial condition or results of operations."

Industry Context

Cybersecurity incidents are a pervasive and growing threat across all industries, including the manufacturing and heavy industry sectors like steel production. Companies are increasingly targeted by sophisticated threat actors, making robust cybersecurity defenses, rapid incident response, and transparent disclosure crucial. Nucor's swift action to contain, assess, and remediate the incident, coupled with its declaration of no material impact, aligns with best practices for managing such events and maintaining operational integrity and investor confidence in a challenging digital landscape.

Legal Proceedings

• Potential regulatory inquiries and/or litigation to which the Company may become subject in connection with the incident are identified as risks.

Stakeholder Impact

• Shareholders: The company's assertion of no material financial impact aims to reassure investors and maintain confidence.
• Employees: Temporary halting of production operations and limitation of IT access could have temporarily affected some employees, but operations have since been restored.
• Customers: Temporary production halts could have led to minor disruptions in supply, but operations are now restored.
• Governmental Regulators: The company acknowledges the potential for regulatory inquiries as a risk, indicating potential scrutiny.

Next Steps

• Reviewing and evaluating the impacted data from the cybersecurity incident.
• Carrying out any appropriate notifications to potentially affected parties and to regulatory agencies as required by applicable law.
• Ongoing assessment of the impacts of the cybersecurity incident, including the potential discovery of additional information related to the incident.

Key Dates

Recommendation

Keywords

Nucor, NUE, cybersecurity incident, data breach, information technology systems, SEC filing, 8-K/A, steel manufacturing, corporate disclosure, risk management