FEDERALItem 1.05 · mandatoryHackingManufacturingManufacturingIron & SteelCapture Stored DataData ExfiltratedLowContained

NUCOR CORPORATION

bd_5d4a1347ab3beb1c · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jun 20, 2025

To disclose

—

Affected

Not disclosed

Linked

6 filings

Confidence

78%

Full breach record for NUCOR CORPORATION →4 incidents on file

Nucor Corporation filed an 8-K/A amendment (Item 1.05) on June 20, 2025 supplementing its May 14, 2025 disclosure of a cybersecurity incident. Investigation determined a threat actor illegally accessed Nucor's IT systems and exfiltrated limited data, causing temporary halt of production at some facilities. Affected operations and IT access have been restored; Nucor believes the threat actor no longer has access. Company states the incident has not had and is not reasonably likely to have a material impact on its business or financials.

J jump to incidentP pin to compareR raw source

SEC clockMateriality determined May 13, 2025 → Filed Jun 20, 202538d ✗ SEC 4-day late

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline — partial

? — ?

Breach window unknown

Jun 20, 2025

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_e8dd270c8f1b4b652025-06-24 · +4dVerified
Vermont State AGbd_f0b0185bf1d1823b2025-06-24 · +4dCandidate
Massachusetts State AGbd_602a58f53ef5e6fe2025-06-27 · +7dVerified
New Hampshire State AGbd_9461555a0a074d8a2025-06-27 · +7dVerified

Show 1 more filing ↓up to 10d gap

New Hampshire State AGbd_70306daf12f7c0d82025-06-30 · +10dVerified

Name: NUCOR CORPORATION
norm: nucor
SEC CIK: 0000073309
Domain: nucor.com

Name: NUCOR CORPORATION
norm: nucor
SEC CIK: 0000073309
Domain: nucor.com
Industry: Steel manufacturing
Industry: Manufacturingllm
NAICS 331110 · Iron and Steel Mills and Ferroalloy Manufacturing

Discovered: —
Materiality determined: May 13, 2025
Notification sent: —
Affected individuals: Not disclosed
Data types: —
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified federal law enforcement authorities

During the incident: Activated its incident response plan
Proactively taking potentially affected systems offline
Restoring affected data from backup systems
Implementing other containment, remediation, and recovery measures
Engaged leading external cybersecurity experts to assist with its investigation and recovery efforts
Notified federal law enforcement authorities
Temporarily and proactively halted certain production operations at various locations
Changes made: Worked with its outside cybersecurity experts to further reinforce its information technology systems and to prevent future unauthorized access
Source: Quoted from the filing itself, not independently verified.

Compliance flags: SEC 4-day late · 38d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
SEC
Materiality determined: May 13, 2025
→ Filed: Jun 20, 2025
38d cal. 4 business days SEC 4-day late

Statute	Window	Elapsed	Threshold	Status
SEC	Materiality determined: May 13, 2025 → Filed: Jun 20, 2025	38d cal.	4 business days	SEC 4-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

SEC 8-KJun 20 · first · this page

Indiana State AG+4d

Vermont State AG+4d

Massachusetts State AG+7d

New Hampshire State AG+7d

New Hampshire State AG+10d

Pattern: first filing Jun 20, last Jun 30 (NH) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/73309/000119312525143135/d926586d8ka.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jun 20, 2025
Raw hash: 7c29c588613feeb13701258aec1806212ba1cdadd486f02654bfd9f33106bd6f

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html34.5 KB

Download View at source

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityNUCOR CORPORATION

Victim entityNUCOR CORPORATION

IncidentUnauthorized Access

Stated responseActivated its incident response plan

ComplianceSEC 4-day late

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing