FEDERALItem 1.05 · mandatoryUnauthorized AccessManufacturingManufacturingIron & SteelLowActive

NUCOR CORPORATION

bd_e268d2c41e8bb27d · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

May 14, 2025

To disclose

—

Affected

Not disclosed

Confidence

77%

Full breach record for NUCOR CORPORATION →4 incidents on file

Nucor Corporation, a Delaware-incorporated steel manufacturer, disclosed under SEC Item 1.05 a cybersecurity incident involving unauthorized third-party access to certain IT systems. Upon detection, Nucor activated its incident response plan, took potentially affected systems offline, halted certain production operations at various locations, engaged external cybersecurity experts, and notified federal law enforcement. The investigation is ongoing; operations are being restarted. Scope, threat actor, data impact, and individuals affected were not disclosed.

J jump to incidentP pin to compareR raw source

SEC clockMateriality determined May 13, 2025 → Filed May 14, 20251d ✓ SEC 4-day OK

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline — partial

? — ?

Breach window unknown

May 14, 2025

Filed

—

No filing yet · watching

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: NUCOR CORPORATION
norm: nucor
SEC CIK: 0000073309
Domain: nucor.com

Name: NUCOR CORPORATION
norm: nucor
SEC CIK: 0000073309
Domain: nucor.com
Industry: Steel manufacturing
Industry: Manufacturingllm
NAICS 331110 · Iron and Steel Mills and Ferroalloy Manufacturing

Discovered: —
Materiality determined: May 13, 2025
Notification sent: —
Affected individuals: Not disclosed
Data types: —
Attack vector: Unauthorized Access
Threat actor: External
Regulator citations: Notified federal law enforcement authoritiesFiled Form 8-K Item 1.05 with the SEC

During the incident: Activated its incident response plan
Proactively taking potentially affected systems offline
Implementing other containment, remediation, or recovery measures
Actively investigating the incident with the assistance of leading external cybersecurity experts
Notified federal law enforcement authorities
Temporarily and proactively halted certain production operations at various locations
Source: Quoted from the filing itself, not independently verified.

Compliance flags: SEC 4-day OK · 1d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
SEC
Materiality determined: May 13, 2025
→ Filed: May 14, 2025
1d cal. 4 business days SEC 4-day OK

Statute	Window	Elapsed	Threshold	Status
SEC	Materiality determined: May 13, 2025 → Filed: May 14, 2025	1d cal.	4 business days	SEC 4-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/73309/000119312525119311/d795264d8k.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: May 14, 2025
Raw hash: 7d5cd0480321d6216865c0ca0e699d8ff9661fa7ba5470dae7fd341c419a1e93

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html31.6 KB

Download View at source

Reporting entityNUCOR CORPORATION

Victim entityNUCOR CORPORATION

IncidentUnauthorized Access

Stated responseActivated its incident response plan

ComplianceSEC 4-day OK

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing