“Our initial response was to isolate the different operations and contain the virus to prevent it from spreading. Then we identified a cure which has allowed us to begin cleaning all servers and computers,” says Chief Financial Officer Eivind Kallevik. “Now, we are in the early stages of the recovery phase, where we will gradually take our IT-operations back to normal mode.”

Internal and external experts are working continuously across Hydro’s global organization to resolve the situation.

“I’m pleased to see committed colleagues across Hydro working with impressive dedication, supported by the best external experts in the world. Together, I’m confident that we will be able to restore operations as soon as possible,” Kallevik says. 

Hydro has reported the cyber attack to Norway’s National Investigation Service (Kripos) and is cooperating with relevant authorities, including the Norwegian National Security Authority (NSM).

Head of Information Systems in Hydro, Jo De Vliegher, underlines the magnitude and complexity of the recovery effort. In this process, all PCs and servers across the company are being reviewed, cleaned for any malware and safely restored, according to strict guidelines to ensure security and safety. Any encrypted PC or server will be rebuilt based on back-ups.

“Safe and secure recovery of Hydro’s IT-operations is our top priority, while we also do our utmost to limit any impact on Hydro’s customers, suppliers and other partners,” says De Vliegher.

Hydro is also working to ensure relevant supporting IT-functions are operational, such as systems for payroll, treasury and reporting, with interim work-around solutions being established when needed and possible.

Update on operational status in the business areas

Energy: Production running as normal

Bauxite & Alumina: Production running as normal

Primary Metal: Production running as normal, with higher degree of manual operation

Rolled Products: Production running as normal, with higher degree of manual operation

Extruded Solutions: Extruded Solutions is expecting to reach an overall production rate of 60 percent by Monday. The business area is concentrating all available resources on enabling further restarts during the coming days to allow for continued deliveries to customers. The Building Systems unit is affected the most, but progress is made, expecting to slowly ramp up production and shipments during the week.

Hydro expects that the process towards full recovery of its IT-systems will take time. However, it is too early how long it will take to resume normal operations, as well as the financial impact.

There have been no reported safety incidents as a result of the cyber attack.