Norsk Hydro LockerGoga Ransomware Attack

What happened

The LockerGoga ransomware infected Norsk Hydro's IT systems, encrypting files on desktops, laptops, and servers across 40 countries. The attack forced the company to halt production at several plants and switch to manual operations.

Technical mechanism

The attackers initially gained a foothold via a weaponized email attachment containing a Trojan, sent from a trusted customer in December 2018. After capturing administrative credentials, they manually deployed the LockerGoga ransomware from the company's own domain controllers.

Why it matters

A landmark ransomware incident demonstrating the devastating impact of cyberattacks on industrial control systems and manufacturing operations, notable for the company's transparent response.

Impact

The attack affected 35,000 employees and disrupted global operations, causing an estimated $71 million in financial losses. The company refused to pay the ransom and rebuilt its systems from backups.

Response

Norsk Hydro shut down its network to contain the spread, engaged Microsoft's Detection and Response Team (DART), and chose to rebuild infrastructure from backups rather than paying the ransom. The company maintained high transparency, holding daily press conferences and webcasts.

Defensive lessons

• Maintain offline, secure backups to enable recovery without paying ransoms.
• Implement robust email security and employee training against phishing.
• Adopt a transparent communication strategy during major cyber incidents.

Evidence register

1. Norsk Hydro — Cyber-attack on Hydro (verified)
2. Microsoft — Hackers hit Norsk Hydro with ransomware. The company responded with transparency (verified)