How long will it take Norsk Hydro to recover from the cyber-attack that crippled the Norwegian aluminum producer's IT network on 19 March?
“I hope it’s not me next,” one aluminium market participant said in response to the cyber-attack that crippled Norwegian aluminium producer Norsk Hydro’s IT network on 19 March.
The cyber-attack on one of the biggest aluminium producers in the world and the second largest in Europe shocked the industry and heightened concerns over cyber security in the metals market. Many in the industry have already been victims of smaller cyber-crimes, but none matched the scale of the hack on Hydro.
Hydro is a leading producer with sophisticated and cutting-edge industrial technology and the group produced 1.1mn t of primary aluminium globally in 2017. The group operates the Alunorte alumina refinery and Albras smelter in Brazil and owns an extrusion business in the US.
The cyber-attack infected the group’s network with a ransomware virus, which encrypted all data within the group, including orders from customers. The data will not be released until the demanded ransom is paid but so far no one has claimed responsibility nor made any demands. This has severely disrupted the group’s production and logistics.
Hydro responded very quickly to isolate global production sites from its network and switched them to manual operations on the day of the attack. Consequently, its primary smelting, bauxite, alumina and energy operations are all running at normal capacity.
But the group’s extrusion business in the US and Europe was hit hard. Several plants in Europe stopped temporarily on the day of the attacks. Restarting the facilities was challenging because the firm could not connect to them. Hydro managed to restart around half of the group’s global extrusion capacity on 21 March and continues work to normalise production.
Hydro is drawing on inventories in order to continue making deliveries to customers and expects further restarts in the coming days. But the company said it is too early to estimate the timeframe to resume full production and gauge the economic impact of the attack.
Although Hydro's billet production in Europe was largely unaffected as the firm switched to manual operation, the delivery of metal was impacted, one European extruder said.
"[Hydro] can't ship the metal as the firm is not connected to the data. It doesn't have the clients' purchase order numbers and shipping addresses," the extruder said.
Furthermore, many of Hydro’s clients relied on the firm’s online portal for information such as currency exchange rates and metal prices. The site also went down as a result of the cyber-attack.
This is not the first cyber-attack to bring chaos to a commodity giant. One of the world’s largest oil producers, Saudi Arabia’s state-owned Saudi Aramco, suffered one of the worst hacks in history in 2012. The cyber-attack forced the firm’s entire supply chain operation on to paper. Similar to Hydro, most of the oil and gas production was automated. It took Aramco five months to recover its online system. The question is, how long will it take for Hydro to get there?
Some in the market are confident that Hydro will recover much sooner but it is still unlikely to escape unscathed.