Norsk Hydro rebuilds after cyberattack

Early on the morning of March 19, global aluminum auto parts supplier Norsk Hydro became the victim of a cyberattack of unknown origin. A ransomware attack known as LockerGoga, according to investigators, entered the Oslo, Norway, company's computer system, encrypted its files and halted operations in multiple locations. The attack forced Hydro to suspend normal operations and switch to manual operations where affected.

Like other ransomware attacks, LockerGoga demanded that Hydro pay a ransom to have its computer system unlocked. The company refused and has taken measures to rebuild its network.

However, the attack has cost Hydro $52 million, according to a statement from the company, and forced it to delay its scheduled April 30 earnings report until June 5.

A month and a half after the incident, speaking from his office in the company's extruded aluminum parts business near Portland, Ore., Mike Tozier, Hydro's manager of advanced product development, said overcoming the crisis remained a work in progress.

Tozier's job is in r&d for automotive aluminum applications — in no way related to the company's computer management or its cybersecurity. But the fact that Tozier, 36, and his colleagues in Oregon were coping with the aftermath several weeks later reveals the seriousness of cyberattack threats. He spoke with News Editor Lindsay Chappell.

Q: Did the cyberattack hit the home office in Norway and spare operations elsewhere, such as yours in North America?

A: No, it was a global impact. Pretty much all employees at all sites were affected by it.

How did the company respond?

There was really good reaction by the team globally to establish workarounds and get operations running again. We've been working through that and have managed to keep supply running.

It happened in March — is everything back in order?

It's an ongoing effort. We're still trying to get all systems back up to 100 percent.

Has the company ascertained who the culprit is?

I can't comment on that because it's an ongoing investigation in Europe into the source. We'll see.