Case study · Manufacturing
Norsk Hydro: producing by hand rather than paying
Norway, 2019. Ransomware hits the whole group; the company refuses to pay, switches to manual operations and communicates openly.
In one sentenceHydro did not pay: it produced by hand and told the truth. The manual mode has to exist before the attack.
- Sector
- Aluminium and energy
- Country
- Norway, 40 countries affected
- Date
- March 2019
- Estimated cost
- NOK 650–750m (about $70m)
- Ransom
- Not paid
Analysis based solely on public information. FZ Consultation was not involved in this incident and has no affiliation with the organizations named.
What happened
- Before the attack
According to a public analysis, the attackers get in through a phishing email sent from a spoofed customer account.
- 19 March 2019
LockerGoga ransomware encrypts thousands of servers and PCs. Some production lines stop, others switch to manual operation.
- First days
Staff work with pen and paper; retirees come back to help with paper-based procedures.
- Following weeks
The company rebuilds from backups and publishes daily updates. The Extruded Solutions division is hit hardest.
- 2020
The annual report puts the total cost at NOK 650–750m.
What went wrong
According to the public sources listed below.
Spread through the directory
Public analyses indicate the attackers gained domain admin rights and used Active Directory to spread.
Operations that depended on IT
Without order books and production schedules, the extrusion plants could not ship.
Lessons for your organization
- 1
A ready-to-use manual mode
Document and rehearse the degraded procedures that keep production going.
Know: measure what stopping would cost - 2
Protect and be able to rebuild the directory
Privileged accounts and Active Directory recovery deserve a dedicated plan.
Prepare: recovery that holds - 3
Transparency as a strategy
Prepared, regular communication preserves the trust of customers and markets.
Prove: rehearse before the real day
Check on Monday morning
Three questions to put to your own organization this week. If you cannot answer one of them in five minutes, that is your first task.
- For your most important service, where is the paper procedure, and when was it last rehearsed?
- Can you rebuild your directory (Active Directory or equivalent) from scratch, and how long would it take?
- Who would speak to customers and markets in the first hour, with what prepared text?
Sources
More case studies
- AWS us-east-1: one empty DNS record, a day of cascading failuresWorldwide, October 2025. A race condition in DynamoDB's DNS automation leaves a region without an address, and many services fall with it.
- Jaguar Land Rover: weeks of idle factories and a state-backed loanUK, 2025. A cyberattack stops production for weeks and reaches over 5,000 organisations across the supply chain.
- Collins Aerospace: one check-in system, four airports on paperEurope, September 2025. Ransomware hits a shared check-in system and forces Heathrow, Brussels, Berlin and Dublin onto manual processes.