NUCOR CORPORATION

Nucor Corporation (CIK 0000732474) filed its 10-K Item 1C disclosure confirming no cybersecurity incidents have materially affected its business, strategy, or financial condition. The filing details a comprehensive cybersecurity risk management program aligned with NIST standards, including third-party risk oversight, Board-level Audit Committee oversight, and an internal Risk Committee. No specific incidents, data breaches, or material impacts were reported.

Nucor Corporation reported unauthorized access to IT systems affecting one New Hampshire resident. The incident occurred between May 3 and May 13, 2025, and was detected on May 13, 2025. Data accessed included SSN, corporate credit card number, and DOB. Nucor engaged third-party cybersecurity specialists, notified law enforcement, and provided 24 months of credit monitoring. Additional technical safeguards were implemented.

Nucor Corporation reported unauthorized access to IT systems affecting one New Hampshire resident. The incident occurred between May 3 and May 13, 2025, and was detected on May 13, 2025. Compromised data included SSN, corporate credit card number, and DOB. Nucor engaged third-party specialists, notified law enforcement, and provided 24 months of credit monitoring.

Nucor Corporation reported a data breach to the Indiana Attorney General. The breach occurred on 2025-05-03 and was reported on 2025-06-24. 32 Indiana residents were affected. 2,461 individuals affected in total.

Nucor Corporation notified Vermont AG of a cybersecurity incident where an unauthorized third party accessed and acquired personal information (including SSNs) from May 3-13, 2025. Nucor engaged forensic specialists, reported to law enforcement, implemented safeguards, and offered 2 years of Equifax credit monitoring.

Nucor Corporation filed an 8-K/A amendment (Item 1.05) on June 20, 2025 supplementing its May 14, 2025 disclosure of a cybersecurity incident. Investigation determined a threat actor illegally accessed Nucor's IT systems and exfiltrated limited data, causing temporary halt of production at some facilities. Affected operations and IT access have been restored; Nucor believes the threat actor no longer has access. Company states the incident has not had and is not reasonably likely to have a material impact on its business or financials.

Nucor Corporation, a Delaware-incorporated steel manufacturer, disclosed under SEC Item 1.05 a cybersecurity incident involving unauthorized third-party access to certain IT systems. Upon detection, Nucor activated its incident response plan, took potentially affected systems offline, halted certain production operations at various locations, engaged external cybersecurity experts, and notified federal law enforcement. The investigation is ongoing; operations are being restarted. Scope, threat actor, data impact, and individuals affected were not disclosed.

Nucor Corporation, a steel manufacturer, experienced an external system breach between May 26, 2023, and June 1, 2023. The incident was discovered on June 3, 2023, affecting 8,824 individuals. The company notified the affected individuals in writing on June 30, 2023, and offered 24 months of credit monitoring services through Equifax.

Nucor Corporation reported a data breach affecting 3 New Hampshire residents. Unauthorized third parties exploited a previously unknown vulnerability in a third-party file transfer software between May 26 and June 1, 2023, to acquire files containing personal information including names, addresses, Social Security numbers, and dates of birth. Nucor disabled access, applied a vendor fix, engaged forensic investigators, and offered credit monitoring services.

Nucor Corporation disclosed a data breach affecting customers' names, bank account numbers, routing numbers, and deposit amounts. The incident stemmed from a vulnerability in a third-party file transfer software vendor. Unauthorized access occurred between May 26 and June 1, 2023. Nucor disabled access, applied a vendor fix, engaged external cybersecurity investigators, and offered two years of Equifax credit monitoring to affected individuals.