Nordic metals firm Hydro restoring systems after cyberattackPosted On: Mar. 20, 2019 11:12 AM CST
(Reuters) — Norsk Hydro ASA, one of the world's largest aluminum producers, has made some progress restoring operations but is not yet back to normal after it was hit by a ransomware cyberattack, the company said on Wednesday.
After the attack late on Monday, the company had to shut down several plants that transform aluminum ingots into components for car makers, builders and other industries, while its smelters in Norway were largely operating on a manual basis.
"Hydro still does not have the full overview of the timeline towards normal operations, and it is still (too) early to estimate the exact operational and financial impact," the company said in a statement.
Hydro said its technical team, with external support, had detected the root of the problems and was working to restart the company's IT systems.
"Progress has been made, with the expectation to restart certain systems during Wednesday, which would allow for continued deliveries to customers," Hydro said of its Extruded Solutions unit as well as of Rolled Products.
The two divisions are key to the company's downstream operation, serving a range of industries with bespoke aluminum components, as well as metal sheets used for packaging, transport and construction.
The Norwegian National Security Authority (NSM), the state agency in charge of cybersecurity, said the attack used a virus known as LockerGoga, a relatively new strain of so-called ransomware, which encrypts computer files and demands payment to unlock them.
The LockerGoga malware is not widely used by cybercrime groups, cybersecurity researchers said, but has been linked to an attack on French engineering consultancy Altran Technologies SA in January.
Hydro said on Tuesday it did not plan to pay the hackers to restore files and would instead seek to restore its systems from backup servers.
There were no signs of similar attacks on other Norwegian companies or public institutions, according to NorCERT, a unit of the NSM handling cyberattacks.
"It's an isolated event," NorCERT head Haakon Bergsjoe told Reuters.
The attack began in the United States on Monday evening and escalated into Tuesday, hitting IT systems across most of the company's activities and forcing staff to issue updates via social media.
The company also posted notes at the entrance to its headquarters, instructing employees not to log their computers onto its networks.
Norsk Hydro's shares rebounded on Wednesday, trading 1% higher, compared with a 0.1% fall in the Oslo benchmark index. The price of aluminum fell 0.1% on the London Metal Exchange.
Companies and governments have become increasingly concerned about the damage hackers can cause to industrial systems and critical national infrastructure following a number of high-profile cyberattacks.
In 2017, hackers later accused by the United States of working for the North Korean government unleashed billions of dollars of damage with the Wannacry ransomware virus, which crippled hospitals, banks and other companies worldwide.
Pyongyang has denied the allegations.
Other cyberattacks have downed electricity grids and transport systems in recent years, and an attack on Italian oil services firm Saipem SpA late last year destroyed more than 300 of the company's computers.
Hydro, which has 36,000 employees in 40 countries, made a net profit of 4.3 billion Norwegian crowns ($505 million) last year on sales of $159.4 billion.