Aluminium manufacturer Hydro crippled by ransomware
Mixed reports suggest a relatively new form of ransomware, LockerGoga, is behind the firm’s IT issues


Hydro, one of the world's biggest aluminium producers, has suffered a cyber attack, forcing its smeltery to continue operations manually.
The company runs operations in 40 countries, is based in Norway, and employs more 35,000 people. It said that the "extensive cyber attack" had impacted the operations of several business areas.
"Hydro has isolated all plants and operations and is switching to manual operations and procedures as far as possible," it said.
"Hydro's main priority is to continue to ensure safe operations and limit operational and financial impact. The problem has not led to any safety-related incidents."
Speaking to the Reuters agency, a spokesperson from the Norwegian National Security Authority (NSM) said the company had been exposed to a ransomware known as LockerGoga, a claim which a Hydro spokesperson declined to confirm.
Hydro said in a more recent update via its Facebook page that most of its business areas are running as normal, albeit on analogue operational systems. The only caveat was that a "lack of ability to connect to the production systems [is] causing production challenges and temporary stoppage at several plants".
Hydro said that the relevant authorities have been notified and are supporting the metal manufacturer through the situation.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
What's really going on?
Until we get any real confirmation on the specifics of the attack, we can't say for certain what exactly happened. "The things we don't know outweigh the things we do know, and that generally means there will be a lot of speculation," said Tim Erlin, VP at TripWire.
IT Pro contacted several analysts about this and there seems to be some consensus on the method of attack, providing reports which suggest it was a ransomware attack can be believed. Most seem to think that in order for the attack to take place, the attacker would have had to deploy the ransomware manually.
"The description of the attack from NOR-CERT so far sounds like the attackers manually deployed the malware after gaining access to the networks," said Chris Doman, security researcher at AT&T Cybersecurity.
"The take-down of a number of different geographic locations is reminiscent of the kind of damage seen in incidents like NotPetya."
Kevin Beaumont, security operations centre manager at BNFL, speaking to the BBC, echoed Doman's thoughts. He said that if the LockerGoga ransomware had been used, then it was likely planted manually by an attacker that gained administrator privileges.
"For an industrial manufacturing business this is potentially bad news, as it may have spread across their company, including near industrial control systems," he added.
Whether or not the attack was caused by ransomware, analysts are keen to express how important it is to continually monitor systems for vulnerabilities.
"This attack provides a lesson in the value of both network segmentation and ensuring that threat models are created, assuming the threat comes from an internal source," said Tim Mackey, senior technical evangelist at Synopsis.
"With increasingly sophisticated attacks, organisations must assume attackers could compromise internal systems as easily as they might attempt to breach a firewall into a production system."
Comparisons have been drawn with the Russian-linked NotPetya attack that struck businesses in 2017, just a month after WannaCry crippled Britain's NHS systems. Of these businesses, shipping giant A.P. Mller-Mrsk was affected hugely - all of its IT systems were rendered useless.
In an event like this, companies are reduced to unorthodox methods in order to maintain operations and keep the chain of command alive. In A.P. Mller-Mrsk's case, the firm famously turned to WhatsApp group messaging and Google Drive file transfers in order to pass down messages through the ranks and fully restore systems.
"We planned and scheduled vessels with marginal data, without incurring delays outside of our normal planning. Many people used their own equipment and took late-night phone calls to make this happen. It was a team effort across the board," says Stephen Davis, Maersk Line's marine manager on the US east coast.
In the wake of the 10-day NotPetya ordeal, A.P. Mller-Mrsk was forced to scrap and replace between 1,500-2,000 of its systems, incurring a total cost of $300m and a marvellous effort from those tasked with replacing the systems. Caleb Barlow, vice president of IBM's X-force threat intelligence cyber security team, said a job like that would usually have taken over a month, but they got it done in a matter of days.

Connor Jones has been at the forefront of global cyber security news coverage for the past few years, breaking developments on major stories such as LockBit’s ransomware attack on Royal Mail International, and many others. He has also made sporadic appearances on the ITPro Podcast discussing topics from home desk setups all the way to hacking systems using prosthetic limbs. He has a master’s degree in Magazine Journalism from the University of Sheffield, and has previously written for the likes of Red Bull Esports and UNILAD tech during his career that started in 2015.
-
M&S suspends online sales as 'cyber incident' continues
News Marks & Spencer (M&S) has informed customers that all online and app sales have been suspended as the high street retailer battles a ‘cyber incident’.
By Ross Kelly
-
Manners cost nothing, unless you’re using ChatGPT
Opinion Polite users are costing OpenAI millions of dollars each year – but Ps and Qs are a small dent in what ChatGPT could cost the planet
By Ross Kelly
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reported
News Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.
By Nicole Kobie
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the last
News Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
By Ross Kelly
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackers
News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
By Emma Woollacott
-
Healthcare systems are rife with exploits — and ransomware gangs have noticed
News Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
By Nicole Kobie
-
Alleged LockBit developer extradited to the US
News A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
By Emma Woollacott
-
February was the worst month on record for ransomware attacks – and one threat group had a field day
News February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
By Emma Woollacott
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impacted
News The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
By Solomon Klappholz
-
Warning issued over prolific 'Ghost' ransomware group
News The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
By Solomon Klappholz