Ransomware Attack Forces Aluminum Manufacturer to Shutdown Systems Worldwide

Photo by Terje Pedersen / NTB scanpix

One of the world’s largest producers of aluminum has been forced to
shut down several of its plants across Europe and the U.S. after an
“extensive cyber attack” hit its operations, leaving companies’ IT
systems unusable.

According to a press release shared by Aluminum giant
Norsk Hydro today, the company has temporarily shut down several
plants and switched to manual operations, “where possible,” in
countries including Norway, Qatar, and Brazil in an attempt to
continue some of its operations.
^[1]

The cyber attack, that began in the U.S.,was first detected by the
company’s IT experts around late Monday evening CET and the company
is working to neutralize the attack, as well as investigating to
know the full extent of the incident.

“Hydro’s main priority is to continue to ensure safe operations
and limit operational and financial impact. The problem has not led
to any safety-related incidents,” the company says.

In an 18-minute-long video press
conference^[2], Norsk Hydro CFO Eivind
Kallevik revealed that Norsk Hydro systems have been hit by a
relatively new strain of ransomware malware, known as LockerGoga,
which encrypts all files on the targeted computers and then demands
a ransom to unlock them, just as other ransomware viruses do.

“The situation is quite severe. The entire worldwide network is
down, affecting all production as well as our office operations,”
Kallevik said.

During the press conference, the Norwegian National Security
Authority (NNSA) also said that the agency is helping Norsk Hydro
with the incident and cooperating with other sectors and
international agencies.

According to the reports published local public broadcaster
NRK and Reuters, says
that according to researchers, LockerGoga is not a widely spread
malware and was also used to target French engineering consultancy
Altran Technologies earlier this year.
^[3][4]

“It is too early to indicate the operational and financial impact,
as well as timing to resolve the situation,” the company says.

Norsk Hydro is the latest victim of so-called ransomware attack
that has crippled many major companies in the past few years.

At this time it’s unknown if the company has lost any
significant data in the attack, and if yes, would it pay or already
consider paying the ransom to the cybercriminals responsible for
the attack whose identity is yet unknown.

But for now, the company said Hydro has cyber insurance and its
main plan is to restore systems using back-up data.

Headquartered in Oslo, Norsk Hydro is one of the largest
aluminum companies worldwide, with operations in some 50 countries
around the world and active on all continents. The company’s shares
went down around 1% at the time of writing due to the incident.

Stay tuned for more updates.