01—Abstract
Summary
Summary of the 8-K/A filed June 20, 2025. Cited figures are marked; the original filing is the authoritative source.
Nucor Corporation (NUE) filed Amendment No. 1 to its Current Report on Form 8-K under Item 1.05 (Material Cybersecurity Incidents) to provide supplemental information about the cybersecurity incident first disclosed in its Original Form 8-K filed May 14, 2025.
The company states that a threat actor illegally accessed certain of its information technology systems, temporarily limiting access to portions of IT applications supporting some operations at some facilities. As a precaution, the company temporarily and proactively halted certain production operations at various locations. The investigation also determined that the threat actor exfiltrated limited data, which the company is reviewing and evaluating, with notifications to affected parties and regulators to be made as required by law.
The company reports that it activated its incident response plan, took potentially affected systems offline, restored affected data from backup systems, engaged external cybersecurity experts, and notified federal law enforcement. Since the Original Form 8-K, affected production operations and access to necessary IT applications have been restored, and the company believes the threat actor no longer has access to its systems. It also states it worked with outside experts to further reinforce its IT systems.
Nucor states that the cybersecurity incident has not had, and is not reasonably likely to have, a material impact on its business operations, financial condition, or results of operations. The filing also includes forward-looking statement cautions, noting risks such as potential additional incident-related information, customer, employee and regulatory relationship impacts, possible regulatory inquiries or litigation, and remediation costs.
02—Key points
Key Highlights
- Amendment No. 1 supplements the Original Form 8-K filed May 14, 2025, under Item 1.05 regarding a cybersecurity incident affecting certain Nucor IT systems.
- A threat actor illegally accessed Nucor's IT systems and exfiltrated limited data, which the company is still reviewing and evaluating.
- Certain production operations at various locations were temporarily and proactively halted as a precaution, and access to some IT applications was limited.
- Affected production operations and necessary IT application access have been restored, and Nucor believes the threat actor no longer has access to its systems.
- Response measures included activating the incident response plan, restoring data from backup systems, engaging external cybersecurity experts, and notifying federal law enforcement.
- Nucor states the incident has not had and is not reasonably likely to have a material impact on its business operations, financial condition, or results of operations.
- Forward-looking statements flag risks including ongoing assessment of the incident, possible regulatory inquiries or litigation, and remediation costs.
03—Questions
Frequently Asked Questions
Has the cybersecurity incident had a material impact on Nucor?
According to the filing, the cybersecurity incident has not had a material impact, and is not reasonably likely to have a material impact, on Nucor's business operations, financial condition, or results of operations.
Were Nucor's production operations affected?
Yes. The filing states that in an abundance of caution, the company temporarily and proactively halted certain production operations at various locations. The filing also states that these affected production operations have since been restored.
Was any data compromised?
The filing states that the company's investigation determined the threat actor exfiltrated limited data from its IT systems. The company is reviewing and evaluating the impacted data and will make notifications to potentially affected parties and regulatory agencies as required by applicable law.
Is the threat actor still in Nucor's systems?
The company believes the threat actor no longer has access to its IT systems. It also states that it worked with outside cybersecurity experts to further reinforce its systems and prevent future unauthorized access.
What are the remaining risks investors should watch?
The forward-looking statements cite risks including the ongoing assessment of the incident and any additional information discovered, the incident's effects on customers, employees and regulators, potential regulatory inquiries or litigation, and remediation and other additional costs.
04—Continue