Manufacturing · 2019
Norsk Hydro and the LockerGoga ransomware attack
35,000 employees sent back to pen and paper.
What happened
On March 19, 2019, LockerGoga ransomware disrupted Norsk Hydro across 170 sites in 40 countries. Accounts were locked, files became unavailable and parts of the business lost access to normal production systems. Plants switched to manual procedures; employees used paper records, and some retirees returned because they still knew the old workflows.
The intrusion had begun about three months earlier, after an employee opened an attachment in a genuine customer email thread. The attackers established a foothold, obtained administrative credentials and used Hydro's own domain infrastructure to distribute the ransomware. Hydro refused to pay, rebuilt from clean backups and published daily updates. It estimated the financial impact at roughly $71M.
What would have changed it
The dangerous part was not the first click; it was the months of undetected access that followed. We train people, monitor identity activity and test recovery before production depends on it.