The BianLian extortion group added Nippon Steel to its dark web leak site on February 13, 2025, claiming to have taken about 500 GB of data from the networks of the Japanese steelmaker's United States operations.
In its posting the group listed accounting records, client financial and personal data, personal folders belonging to network users, files pulled from management computers, file server contents, production data and personnel records. Cybernews, which first reported the listing, said the advertised material also included direct contact details for senior Nippon Steel executives. BianLian said it would publish the files in stages unless its demands were met, consistent with the group's shift away from file encryption toward pure data extortion.
Nippon Steel is the world's fourth largest crude steel producer, and the claim surfaced while the company was contesting the blocked acquisition of United States Steel. The company did not publicly confirm or deny the intrusion, and the entry was removed from BianLian's site after a short period. None of the material was independently verified, and the volume and contents remained the attackers' claims alone.
A separate incident later affected the group. Nippon Steel Solutions disclosed in July 2025 that a zero-day exploit against network equipment, detected on March 7, 2025, had exposed contact details for customers, partners and employees. SecurityWeek, reporting that disclosure, noted that any connection between the two events remained unclear.