> series: anatomy_of_a_breach —— part: 123 —— target: norsk_hydro —— ransomware: lockergoga —— cost: $75,000,000 —— ransom_paid: none<span class="cursor-blink">_</span>_
On 19 March 2019, Norsk Hydro — one of the world's largest aluminium producers, with operations in 40 countries and 35,000 employees — was hit by LockerGoga ransomware that encrypted IT systems across its global operations. Automated production lines were shut down. Smelting plants — which run continuous processes that cannot simply be stopped — switched to manual operations. Office workers were locked out of all computer systems. The company reverted to paper-based processes across its worldwide operations.
Hydro's response became a benchmark for incident management. The company refused to pay the ransom, communicated transparently with stakeholders through regular press conferences (initially using a backup laptop and 4G connection), and methodically rebuilt its IT infrastructure from backups over the following weeks. CEO Svein Richard Brandtzæg personally fronted communications. The total cost exceeded $75 million — but the company's reputation emerged enhanced rather than damaged, because of how it handled the crisis.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallAluminium smelting is a continuous process — molten metal at 960°C cannot be safely stopped and restarted. When LockerGoga encrypted Hydro's IT systems, the smelting plants could not simply shut down — they had to continue operating with manual controls, paper records, and verbal communication. This is the nightmare scenario for manufacturing: ransomware that disrupts not just IT but physical production processes with safety implications.
The Norsk Hydro attack confirmed what Stuxnet (2010), Shamoon (2012), and the Ukraine power grid attack (2015) had established: cyber attacks against industrial and manufacturing operations can have physical consequences. For UK manufacturers, the Hydro case is directly relevant — and the defence requires both IT security (patching, MFA, monitoring) and OT resilience (manual operation procedures, IT/OT segmentation, tested recovery plans).
Cyber Essentials certification establishes IT security baseline. Our infrastructure penetration testing includes IT/OT boundary assessment. SOC in a Box for Manufacturing and Engineering provides 24/7 monitoring across IT and OT environments. And UK Cyber Defence provides the incident response and crisis management capability that Hydro demonstrated so effectively.
<a href="/penetration-testing/infrastructure">Infrastructure testing</a> validates IT/OT security and backup integrity. <a href="https://www.socinabox.co.uk/sectors/engineering-contractors">SOC in a Box for Manufacturing</a> monitors 24/7. <a href="https://www.cyber-defence.io/services/incident-response">UK Cyber Defence</a> manages the crisis.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call