Aluminum maker Norsk Hydro battling ransomware attack.
Several plants closed, smelters work manually
OSLO • Norsk hydro, one of the world’s largest aluminum producers, battled on Tuesday to contain a cyber attack which halted parts of its production, the latest example of the damage hackers can cause to business and industry.
The company shut several metal extrusion and rolled products plants, which transform aluminum ingots into components for carmakers, builders and other industries, while its giant smelters in Norway were largely operating on a manual basis.
“This is a classic ransomware attack,” chief financial officer eivind Kallevik told a news conference, adding that the company had not identified the hackers. “The situation is quite severe.”
The Norwegian National Security Authority (NNSA), the state agency in charge of cybersecurity, said the attack used a virus known as LockerGoga, a relatively new strain of so-called ransomware which encrypts computer files and demands payment to unlock them.
Kallevik, who could not turn on his desktop computer or access files, would not say whether a specific sum had been asked for. however, when asked if the company planned to pay to unlock its systems, he said the intention was to restore them from backup servers.
“We have good backup systems and we have plans on how to restore it,” he said.
The attack began in the United States on Monday evening and escalated overnight, hitting IT systems across most of the company’s activities and forcing staff to issue updates via social media.
“It is too early to indicate the operational and financial impact, as well as timing to resolve the situation,” hydro said in a regulatory filing via the Oslo Stock exchange.
however, Kallevik said the financial impact was limited so far.
“It is mostly direct labour: some of the activities that we use computers to do, today we use manual labour. We have to add some more people,” he told reuters.
News of hydro’s plant outages pushed aluminum prices to a three-month high on the London Metal exchange. The company’s shares fell as much 3.4 per cent before recovering to trade 0.8 per cent lower by 1438 GMT.
The LockerGoga malware is not widely used by cyber crime groups, security researchers said, but has been linked to an attack on French consultancy Altran Technologies in January.
haakon Bergsjoe, head of NNSA’s National cyber Security centre, said there were no reports of other companies affected on Tuesday. All major Norwegian companies had been warned in the wake of the attack on hydro, he told reuters.
The last publicly acknowledged cyber attack in Norway was on software firm Visma, when hackers allegedly working on behalf of chinese intelligence breached its network to steal secrets from its clients.