SOCFortres5: Nippon Steel Targeted in Sophisticated Zero-Day Cyberattack, Data Breach Confirmed

Nippon Steel, one of the world’s largest steel producers, has confirmed that it was the victim of a sophisticated cyberattack exploiting a zero-day vulnerability. The attack targeted its IT subsidiary, Nippon Steel Solutions (NS Solutions), and resulted in unauthorized access to internal systems and the theft of sensitive data. The breach was detected on March 7, 2025, prompting immediate containment efforts.

According to NS Solutions, the attackers exploited an unknown vulnerability in network equipment — a classic example of a zero-day attack, which involves flaws that are not yet patched or publicly known. After discovering suspicious activity, the company isolated the compromised servers and brought in external cybersecurity experts to assess the scope and impact of the breach.

The investigation revealed that various categories of data were exposed. This includes personal and business information belonging to customers, business partners, and employees. The stolen data likely includes names, company affiliations, job titles, addresses, business email addresses, and phone numbers. For internal employees, details such as department names and professional contact information were also compromised.

While there is currently no indication that the stolen information has been leaked on the dark web or social media, NS Solutions has warned affected parties to be cautious of phishing attempts or other suspicious communication. The company emphasized that the breach could potentially lead to social engineering attacks targeting victims using the stolen information.

As part of its incident response, NS Solutions took significant remediation steps. These included rebuilding the compromised network environment, enhancing outbound traffic monitoring, strengthening behavioral analysis systems, and implementing early threat detection protocols. The breach has been reported to law enforcement agencies and Japan’s Personal Information Protection Commission, as required under data protection laws.

Interestingly, this attack follows a previous cybersecurity incident in February 2025, when the BianLian ransomware gang claimed to have stolen 500 GB of sensitive data from Nippon Steel. The newly reported zero-day attack, however, appears to be distinct, though questions remain about whether the two incidents may be related or part of a broader targeted campaign against the company.

In summary, the breach underscores the increasing risk that even industrial giants face from advanced persistent threats leveraging zero-day vulnerabilities. With over 113,000 employees and a vast network of partners and clients, the impact of this incident could extend well beyond the company itself. Stakeholders are urged to remain vigilant and adopt necessary cybersecurity hygiene practices to prevent further fallout.