Anatomy of a Breach

Anatomy of a Breach: Norsk Hydro — LockerGoga Ransomware Shuts Down a Global Aluminium Manufacturer

> series: anatomy_of_a_breach —— part: 123 —— target: norsk_hydro —— ransomware: lockergoga —— cost: $75,000,000 —— ransom_paid: none<span class="cursor-blink">_</span>_

Hedgehog Security 31 March 2019 14 min read

A global aluminium manufacturer. Manual smelting operations. $75 million to recover. Zero paid in ransom.

On 19 March 2019, Norsk Hydro — one of the world's largest aluminium producers, with operations in 40 countries and 35,000 employees — was hit by LockerGoga ransomware that encrypted IT systems across its global operations. Automated production lines were shut down. Smelting plants — which run continuous processes that cannot simply be stopped — switched to manual operations. Office workers were locked out of all computer systems. The company reverted to paper-based processes across its worldwide operations.

Hydro's response became a benchmark for incident management. The company refused to pay the ransom, communicated transparently with stakeholders through regular press conferences (initially using a backup laptop and 4G connection), and methodically rebuilt its IT infrastructure from backups over the following weeks. CEO Svein Richard Brandtzæg personally fronted communications. The total cost exceeded $75 million — but the company's reputation emerged enhanced rather than damaged, because of how it handled the crisis.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

When ransomware hits a smelter, you cannot just 'switch it off'.

Aluminium smelting is a continuous process — molten metal at 960°C cannot be safely stopped and restarted. When LockerGoga encrypted Hydro's IT systems, the smelting plants could not simply shut down — they had to continue operating with manual controls, paper records, and verbal communication. This is the nightmare scenario for manufacturing: ransomware that disrupts not just IT but physical production processes with safety implications.

IT/OT Convergence Risk
Hydro's IT systems were encrypted; its OT (operational technology) systems in the smelters continued running but without the IT-dependent automation, monitoring, and quality control systems. This IT/OT dependency is the same convergence risk identified in our <a href="/blog/anatomy-of-a-breach-stuxnet">Stuxnet</a> (2010) and <a href="/blog/sector-under-the-microscope-manufacturing">manufacturing sector</a> analyses. Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> assesses IT/OT boundary security.
Exemplary Incident Response
Hydro's transparency — holding press conferences, publishing recovery progress updates, and refusing to pay — was widely praised as a model for corporate incident response. <a href="https://www.cyber-defence.io/services/incident-response">UK Cyber Defence</a> provides the incident response planning and execution capability that enables this standard of crisis management.
Rebuilt from Backups
Hydro recovered without paying because it had functional backups. The recovery took weeks and cost $75 million — but the alternative (paying an unknown amount to criminals with no guarantee) was worse. <a href="/penetration-testing/infrastructure">Infrastructure testing</a> validates backup integrity and recovery procedures.
$75 Million Recovery vs Unknown Ransom
The $75 million recovery cost was enormous — but Hydro's insurance covered a significant portion, and the company's reputation was preserved. Paying the ransom would have funded further attacks and provided no guarantee of recovery. <a href="/cyber-essentials">Cyber Essentials</a> reduces the risk of ransomware infection in the first place.

Ransomware against manufacturing has physical consequences.

The Norsk Hydro attack confirmed what Stuxnet (2010), Shamoon (2012), and the Ukraine power grid attack (2015) had established: cyber attacks against industrial and manufacturing operations can have physical consequences. For UK manufacturers, the Hydro case is directly relevant — and the defence requires both IT security (patching, MFA, monitoring) and OT resilience (manual operation procedures, IT/OT segmentation, tested recovery plans).

Cyber Essentials certification establishes IT security baseline. Our infrastructure penetration testing includes IT/OT boundary assessment. SOC in a Box for Manufacturing and Engineering provides 24/7 monitoring across IT and OT environments. And UK Cyber Defence provides the incident response and crisis management capability that Hydro demonstrated so effectively.


Norsk Hydro: $75 million, zero ransom paid, reputation enhanced. Could your manufacturing operation say the same?

<a href="/penetration-testing/infrastructure">Infrastructure testing</a> validates IT/OT security and backup integrity. <a href="https://www.socinabox.co.uk/sectors/engineering-contractors">SOC in a Box for Manufacturing</a> monitors 24/7. <a href="https://www.cyber-defence.io/services/incident-response">UK Cyber Defence</a> manages the crisis.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles