Namely, Norsk Hydro computer systems were hit by the comparatively new LockerGoga virus at first, before spreading to its network encrypting files.

Due to the attack, the company had to pause production in several plants, switching to increased manual operations to bypass problems connecting to its production systems. LockerGoga demanded payment for the decryption of infected files.

In four out of five business areas, production is running at normal speed, but with manual workarounds, the company informed in an official update on 28 March.

Meanwhile, Extruded Solutions, the business area hardest affected, is approaching normalized production levels.

Hydro’s primary objective remains to restart operations in a safe and secure manner, gradually progressing production back to normal, and limiting any further impact on customers, suppliers and other partners,

...the statement reads.

Hydro is also working to ensure IT capabilities for internal administrative processes, such as systems for payroll, treasury and reporting, some of which have been affected by the cyber attack.

Update on operational status in the business areas, as of 28 March:

  • Energy: Production running as normal
  • Bauxite & Alumina: Production running as normal
  • Primary Metal: Production running as normal, with higher degree of manual operation
  • Rolled Products: Production running as normal, with higher degree of manual operation
  • Extruded Solutions: Production in the three business units Extrusion Europe, Extrusion North America and Precision Tubing currently running at an average output of 80-85%. In the Building Systems unit operations are currently at 40-50%, up from 20% on Wednesday. There are still local variations from plant to plant. Based on current progress, the expectation is for Building Systems to continue gradually ramping up production and shipments during the week.

This attack is a showcase of the increasing risk that maritime and ocean companies face, warned Per Martin Tanggaard, Director of Nor-Shipping, shortly after the incident.