Taiwanese semiconductor maker Foxsemicon Integrated Technology Inc., a subsidiary of Hon Hai Precision Industry Co. Ltd., better known as Foxconn, has been hijacked by the LockBit ransomware gang, which made a ransom demand.

The Taipei Times reported today that the Foxsemicon website showed a message in English that claimed that 5 terabytes of data had been stolen. The message included a statement to customers from the hackers claiming that all their personal data had been stolen. It was followed by a message to Foxsemicon employees stating, “If your management does not contact us, you will lose your job, as we are able to completely destroy Foxsemicon with no possibility of recovery.”

In a statement to the Taiwan Stock Exchange, Foxsemicon said this afternoon local time that it had recovered its website and that it was working with security experts. The Foxsemicon website currently is no longer showing the message from the hackers.

The LockBit ransomware gang emerged in 2020 and operates on a ransomware-as-a-service model, where affiliates use already developed ransomware to execute attacks. In its time, LockBit has regularly been one of the most prolific ransomware groups and was named as the most active threat actor on the planet in January 2023.

Previous LockBit victims include Managed Care of North America Inc. in May. A suspected gang affiliate was also arrested in Arizona in June 2022 and accused of being involved in multiple LockBit ransomware attacks against victims in the U.S., Asia, Europe and Africa.

The timing of the attack may not be coincidental. Ben Forster, senior director of product at cybersecurity provider AttackIQ Inc., told SiliconANGLE that the “attack comes during heightened concerns about cyberattacks on Taiwan amidst their upcoming general election” and that only “last month, Taiwanese government officials called on the U.S. Treasury Department for support due to heightened security vulnerability.”

Sean Deuby, principal technologist at Active Directory security company Semperis Inc., added that it’s essential for organizations to know what their critical systems are, including infrastructure such as Active Directory, before ransomware attacks occur. “Oftentimes, the threat actors breach an organization’s identity systems,” he said. “By preparing in peacetime, defenders can make their organizations sufficiently difficult to compromise that hackers will look for softer targets.”

Image: Bing Image Creator