Volume 2Manufacturing edition2019Last verified 23 sources, 19 primaryAttacker not named by any court
In March 2019 ransomware spread across Hydro's global network and stopped several extrusion plants. The smelters ran on, with more done by hand, and Hydro briefed the public in the open from the first afternoon.
By the account Hydro and Microsoft staff gave in a Microsoft feature, the attack was ordinary: an email attachment, captured administrative credentials, ransomware pushed from Hydro's own domain controllers. The response was not. Hydro isolated every plant, went to manual procedures where it could, and briefed the public by webcast the same afternoon. It is the benchmark, and it should be said plainly.
The metal was fine. The instructions were not. Primary plants in Norway ran with more done by hand; extrusion plants stopped or slowed, unable to connect to the production systems that told each press what to run. In BlastWave's analysis, not a disclosed fact, the businesses that kept running had a way to run without the network, and the ones that stopped shared fate with everything else. Which of your lines could run tonight with the domain gone, and who would know how?
What is not known: Hydro never published a technical account. How the ransomware reached plant production systems, and whether any plant control system was encrypted rather than cut off, is undisclosed. The email and domain controller account comes from a Microsoft feature quoting Hydro and Microsoft staff, not from a Hydro report. The ransom demanded was never stated. The cost net of insurance is unpublished: compensation recognised through late 2020 is on the record, any final total is not. No court has convicted anyone, and the US charging release names Norway, not Hydro.
Recommendation
Take the domain away from the plants Systems that tell a line what to run should not be joined to or reachable from the business domain, so a push from a compromised domain controller has nowhere to land.
Remove standing administrative reach No credential captured on the business side should install software in a plant. Access to production systems is per session, tied to a named person, and expires.
Make orders flow one way to the floor The plant reads orders from the business, never the reverse, and holds a current local copy so the first shift can run on paper if the feed stops.
Sources: Hydro releases, 19-28 Mar 2019; Hydro Q4 2019 results, 7 Feb 2020; Hydro, “Cyber-attack on Hydro” page; Microsoft feature, 16 Dec 2019; Eurojust, 29 Oct 2021; US DOJ release, 9 Sep 2025. Full list with links.
Soft Spots: Initial access and the domain controller push are Microsoft's account, not a Hydro report. The shared-fate reading is BlastWave's analysis. Whether any plant control system was encrypted is not on the record.
The full record
Every claim numbered to its source. Last updated .
Ransomware stopped several extrusion plants while the smelters ran on with more done by hand, and Hydro briefed the public from the first afternoon. What is verified, what is only reported, and what is still unknown.
Summary
In the early hours of 19 March 2019, ransomware spread across Norsk Hydro's IT network. The Norwegian aluminum company isolated its plants: primary plants in Norway ran with more manual work, while several extrusion plants stopped. Hydro did not pay and estimates the total cost at around NOK 800 million. Whether any plant control system was encrypted is not stated.1,2
Timeline of the Norsk Hydro ransomware attack
Every date is tied to a source. Press reporting appears only as evidence of what was said.
An email attachment sent by a trusted customer is weaponized, according to Hydro's information security officer as quoted in a Microsoft feature a year later. Hydro published no technical report.5
Hydro is hit by an extensive cyberattack. It isolates all plants and operations and switches to manual procedures as far as possible. Extrusion and rolled products plants cannot connect to their production systems; several stop temporarily.1
Hydro holds an analyst and press conference in Oslo, broadcast by webcast. No safety incidents are reported.1
Extruded Solutions is running at about 50 percent of normal capacity.12
Hydro's head of information systems says many systems were shut down not because they were infected but to contain the virus. Kripos and the Norwegian National Security Authority (NSM) are engaged.4
First cost estimate: around NOK 300 to 350 million for the first full week. Three Extruded Solutions units are at 70 to 80 percent; Building Systems is nearly halted. Media update by webcast at 14:30 CET.13
Four of five business areas are running at normal speed, with manual workarounds. Three Extruded Solutions units average 80 to 85 percent; Building Systems is at 40 to 50 percent.3
FireEye ties the criminal group FIN6 to LockerGoga and Ryuk ransomware in general. The report does not mention Hydro.16
Hydro postpones its first quarter report to 5 June because of the attack.17
Hydro estimates the first quarter impact at NOK 400 to 450 million.18
The first quarter report puts the first quarter impact at NOK 300 to 350 million and forecasts around NOK 200 to 250 million for the second quarter.6
Reinsurance News reports the attack could cost "as much as $69 million" over the first two quarters, a dollar conversion of Hydro's kroner figures.19
Second quarter impact: NOK 250 to 300 million, of which NOK 150 to 200 million in Extruded Solutions.20
First half impact around NOK 550 to 650 million; first insurance compensation recognized, NOK 33 million.7
Microsoft publishes a feature quoting Hydro and Microsoft staff on the initial access and the domain controller push.5
Full year 2019 impact around NOK 650 to 750 million; NOK 187 million insurance compensation recognized.8
NOK 113 million insurance compensation recognized.14
NOK 192 million insurance compensation recognized, in Extruded Solutions.15
Eurojust announces that 12 people were targeted over attacks using LockerGoga, MegaCortex and Dharma, with Norwegian police taking part. The same day, Norwegian police link the operation to the Hydro attack, as reported by TechCrunch and Finansavisen.9,10,21
kode24 reports a police statement that decryption keys were found in material seized in the autumn 2021 operation.22
Arrests in Ukraine, including the group's alleged ringleader, announced by Europol on 28 November.23
The US Justice Department unseals charges against Volodymyr Tymoshchuk over LockerGoga, MegaCortex and Nefilim. The release lists Norway among the countries affected; it does not name Hydro.11
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Around NOK 800 million, on an undated Hydro page; gross or net of insurance not stated2
Verified (estimate, undated)
Cost net of insurance
Not published. Recognitions of NOK 33m, 187m, 113m and 192m through October 2020 are on the record7,8,14,15
Undisclosed
Has anyone been convicted?
No. One man is charged in the US; the release names Norway, not Hydro11
Charged, not convicted
Were Norsk Hydro's smelters or plant control systems hacked?
The record says neither: Hydro describes an IT compromise that halted some physical operations, and has never said whether any plant control system was encrypted. On the first morning Hydro isolated all plants and operations and switched to manual procedures as far as possible. Its release that day described its primary plants in Norway as1
"running as normal, with higher degree of manual operations"
The same release said extrusion and rolled products plants suffered from "lack of ability to connect to the production systems," which caused temporary stoppages at several of them.1 On 22 March, Hydro's head of information systems said many systems had been shut down not because they were infected but to contain the virus.4 Part of the outage was containment, chosen on purpose.
So the smelters kept running and some press lines stopped because they lost the systems that told each press what to run. Hydro published no technical account of how the ransomware reached plant production systems. The accurate summary is that this was an IT compromise that stopped physical operations. Nothing in the record says the operational technology was hit, and nothing says it was clean.
How did the ransomware get into Norsk Hydro?
The only public account is Microsoft's: an email attachment in December 2018, then a push from Hydro's own domain controllers three months later. Hydro published no technical report. In a Microsoft feature of 16 December 2019, Hydro's information security officer said an email attachment sent by a trusted customer had been weaponized in December 2018, and that antivirus caught it days later, too late.5
In the same feature, Microsoft's incident responder said the attacker captured administrative credentials and pushed the ransomware from Hydro's own domain controllers.5 That is Microsoft's account, quoting Hydro and Microsoft staff in a vendor feature. It is not a Hydro statement, and it is labeled that way everywhere on this page.
Microsoft's feature describes the scale as "thousands of servers and PCs."5 Hydro's own word for the reach was "our entire global organization."6
How much did the Norsk Hydro cyberattack cost?
Hydro estimates the total cost at around NOK 800 million. Hydro reports in Norwegian kroner and has published no dollar figure. Its standing page on the attack says:
"Hydro has estimated the total cost to be around 800 MNOK."
The page is undated, and it does not say whether the total is before or after insurance. The estimate moved as Hydro counted. Each step is dated and in kroner:
26 March 2019: around NOK 300 to 350 million for the first full week.13
30 April 2019: NOK 400 to 450 million for the first quarter.18
5 June 2019: NOK 300 to 350 million for the first quarter, with around NOK 200 to 250 million forecast for the second.6
23 July 2019: NOK 250 to 300 million for the second quarter, of which NOK 150 to 200 million in Extruded Solutions.20
23 October 2019: around NOK 550 to 650 million for the first half.7
7 February 2020: around NOK 650 to 750 million for the full year 2019.8
Undated standing page: around NOK 800 million total.2
Insurance is a separate line. Hydro recognized insurance compensation of NOK 33 million in the third quarter of 2019, NOK 187 million in the fourth quarter of 2019, NOK 113 million in the first quarter of 2020 and NOK 192 million in the third quarter of 2020.7,8,14,15 Those four add up to NOK 525 million; that sum is our arithmetic, not a Hydro total. Whether more was recognized after October 2020 was not established in our review.
The dollar figures in circulation are other people's conversions. On 6 June 2019 Reinsurance News wrote that the attack could cost "as much as $69 million" over the first two quarters, converting a first-quarter estimate and a second-quarter forecast.19 Microsoft's December 2019 feature said the financial impact "would eventually approach $71 million."5 Hydro kept counting after both.
Why is Norsk Hydro the benchmark for incident transparency?
Because it told the public what it knew while the incident was still happening, and left a dated record anyone can check. Nobody required any of it.
On the first day it published two releases and held an analyst and press conference in Oslo at 15:00 CET, by webcast.1
Within days it published capacity by business area, and on 26 March it gave a first cost estimate and a further webcast briefing.3,12,13
On 12 April it explained in advance that its first quarter report would move to 5 June.17
Microsoft's feature describes "daily" press conferences; Hydro's releases confirm webcast briefings on 19 and 26 March.1,5,13 The open record has a practical value beyond reputation. Because Hydro published every estimate as it went, each dated and in kroner, anyone can check which number is which, including against the dollar figure that later circulated as Hydro's cost.
What is still not known about Norsk Hydro
How the ransomware reached plant production systems. Hydro never published a technical account.
Whether any plant control system was encrypted rather than cut off or shut down to contain the spread.1,4
Whether plant systems sat inside the corporate domain. Hydro never published its architecture.
Independent confirmation of the initial access. The email and domain controller account comes only from a Microsoft feature quoting Hydro and Microsoft staff.5
The ransom demanded. It was never stated.
The cost net of insurance. Compensation recognized through October 2020 is on the record; any later recognition or final total is not.15
When Hydro made the around NOK 800 million estimate, and whether it is gross or net of insurance. The page is undated.2
Whether the US indictment names Hydro. The Justice Department release does not.11
Who carried out the attack, as a matter of law. No court has convicted anyone.
Claims about Norsk Hydro the record does not support
Widely repeated claim
What the record says
"Norsk Hydro expecting $69m hit from cyber attack."
Hydro never gave a dollar figure. The $69 million was a trade publication's conversion of a first-quarter estimate plus a second-quarter forecast. Hydro kept counting: around NOK 650 to 750 million for 2019, and around NOK 800 million in total.2,6,8,19
"The financial impact would eventually approach $71 million."
A Microsoft feature, December 2019. Hydro's own estimates are in kroner: around NOK 650 to 750 million for 2019 and around NOK 800 million in total.2,5,8
"FIN6 attacked Norsk Hydro."
FireEye tied FIN6 to LockerGoga in general in April 2019 without naming Hydro. No document ties FIN6 to Hydro.16
"Hydro held daily press conferences."
"Daily" is Microsoft's description. Hydro's releases confirm webcast briefings on 19 and 26 March 2019.1,5,13
Including our own. Hackopedia Volume 1 carried Norsk Hydro's cost in dollars, as "~$75M in losses" and "between $40 million and $75 million," when Hydro's own estimates are in kroner and run to around NOK 800 million.2 It named FIN6 as the attacker on the strength of a vendor report that tied the group to LockerGoga in general and never mentioned Hydro.16 It also reported a first-quarter production drop of about 15,000 tons that we could not trace to any Hydro document. All three are corrected here. We correct our own record first; it is what earns the right to correct anyone else's.
Who was behind the Norsk Hydro attack?
No court has convicted anyone. One man is charged in the United States, and the charging release does not name Hydro.
On 29 October 2021 Eurojust announced that 12 people had been targeted for involvement in attacks using LockerGoga, MegaCortex and Dharma, with Norwegian police taking part. Eurojust's word is "targeted," not "arrested," and its release does not name Hydro.9 The same day, Norwegian police linked the operation to the Hydro attack, as reported by TechCrunch and Finansavisen; the police release itself was not located.10,21
In September 2022 kode24 reported a police statement that decryption keys had been found in material seized in the autumn 2021 operation.22 On 28 November 2023 Europol announced arrests in Ukraine on 21 November, including the group's alleged ringleader.23
On 9 September 2025 the US Justice Department unsealed charges against Volodymyr Tymoshchuk, a Ukrainian national, over LockerGoga, MegaCortex and Nefilim. The release lists Norway among the countries where the variants were used. It does not name Hydro, and whether the indictment itself names Hydro was not established.11 He is charged, not convicted.
FIN6 does not belong in this account. FireEye tied that group to LockerGoga deployments in general on 5 April 2019, weeks after the attack, without naming Hydro.16 That is adjacency, not attribution.
BlastWave analysis: the metal was fine, the instructions were not
Analysis, not a disclosed fact
By the account Hydro and Microsoft staff gave in a Microsoft feature, the attack was ordinary: an email attachment, captured administrative credentials, ransomware pushed from Hydro's own domain controllers.5 The response was not ordinary. Hydro isolated every plant, went to manual procedures where it could, and briefed the public by webcast the same afternoon.1 It is the benchmark, and it should be said plainly. On the consequence ladder this is an IT compromise halting physical operations, and nothing in the record puts it higher.
That split is the lesson. The primary plants ran with more done by hand; extrusion plants stopped or slowed because they could not connect to the production systems that told each press what to run.1 This is BlastWave's analysis rather than a disclosed fact: the businesses that kept running had a way to run without the network, and the ones that stopped depended on systems that shared fate with everything else. Hydro never published its architecture, and whether plant systems sat inside the corporate domain is not on the record. The fallback question does not need the answer. Which of your lines could run tonight with the domain gone, and who would know how?
Podcast: “Map and Compass” (9:26). Joe Baxter and Cam Cullen on why the smelters kept running while the presses lost their orders, and how Hydro's open disclosure made its own numbers checkable.
Video: Norsk Hydro Short (60 to 90 seconds).
Frequently asked questions
What happened in the Norsk Hydro cyberattack?
In the early hours of 19 March 2019, ransomware spread across the IT systems of Norsk Hydro, the Norwegian aluminum company. Hydro isolated all plants and switched to manual procedures where it could. Its primary plants in Norway kept running with more manual work, while several extrusion and rolled products plants stopped temporarily because they could not connect to their production systems. By 28 March, four of five business areas were at normal speed.
Were Norsk Hydro's smelters or control systems hacked?
Hydro said on 19 March 2019 that its primary plants in Norway were running as normal, with a higher degree of manual operations. Extrusion and rolled products plants stopped because they could not connect to production systems, and on 22 March Hydro said many systems were shut down to contain the virus rather than because they were infected. Whether any plant control system was encrypted has never been stated publicly.
How did hackers get into Norsk Hydro?
Hydro has published no technical report. The only public account is a Microsoft feature of 16 December 2019, in which Hydro's information security officer said an email attachment from a trusted customer was weaponized in December 2018, and a Microsoft incident responder said the attackers captured administrative credentials and pushed the ransomware from Hydro's own domain controllers. That is Microsoft's account, not a Hydro report.
How much did the Norsk Hydro attack cost?
Hydro reports in Norwegian kroner. Its standing page on the attack, which is undated, says the company estimated the total cost at around NOK 800 million. Its fourth quarter 2019 results, published on 7 February 2020, put the full-year 2019 impact at around NOK 650 to 750 million. Hydro does not say whether the total is before or after insurance, and it has published no dollar figure.
Where does the $70 million figure for Norsk Hydro come from?
It is not Hydro's figure. On 6 June 2019 the trade publication Reinsurance News wrote that the attack could cost as much as $69 million over the first two quarters, a dollar conversion of Hydro's kroner estimate for the first quarter and forecast for the second. Microsoft's December 2019 feature said the impact would approach $71 million. Hydro kept counting and now estimates around NOK 800 million in total.
Did Norsk Hydro pay the ransom?
No. Hydro did not pay the ransom and rebuilt its affected servers and PCs from backups, according to its standing page on the attack and a Microsoft feature published on 16 December 2019. The amount the attackers demanded has never been stated publicly, and Hydro reported no safety incidents during the attack.
Who was behind the Norsk Hydro attack?
No one has been convicted. On 29 October 2021 Eurojust announced that 12 people were targeted over LockerGoga, MegaCortex and Dharma attacks, and Norwegian police linked them to the Hydro attack, as reported at the time. On 9 September 2025 the US Justice Department unsealed charges against Ukrainian national Volodymyr Tymoshchuk over LockerGoga, MegaCortex and Nefilim. The release lists Norway among the countries affected but does not name Hydro.
Was FIN6 behind the Norsk Hydro attack?
No document ties FIN6 to Hydro. On 5 April 2019 FireEye tied FIN6 to LockerGoga and Ryuk ransomware in general, without mentioning Hydro. Hackopedia Volume 1 printed that adjacency as attribution, and this entry corrects it. Norwegian police linked people targeted in a 2021 European operation to the attack, as reported at the time, but no court has convicted anyone.
Primary sources are Norsk Hydro's own dated releases and quarterly reports, the Eurojust, Europol and US Justice Department releases, and the Microsoft feature quoting Hydro and Microsoft staff, labeled as such. Press is cited only as evidence of what was said.
CompanyNorsk Hydro, "Hydro subject to cyber attack" and "Update: Hydro subject to cyber attack," 19 March 2019 (analyst and press conference, Oslo, 15:00 CET, webcast). hydro.com · Update
CompanyNorsk Hydro, "Cyber-attack on Hydro," standing page, undated. hydro.com
CompanyNorsk Hydro, "Update on cyber attack," 28 March 2019. hydro.com
CompanyNorsk Hydro, "Update on cyber attack," 22 March 2019. hydro.com
CompanyMicrosoft (Bill Briggs), "Hackers hit Norsk Hydro with ransomware. The company responded with transparency," 16 December 2019, updated 9 May 2023. Quotes Torstein Gimnes Are (Hydro) and Jim Moeller (Microsoft DART). A vendor feature; the only public source for the initial access and the domain controller account. microsoft.com
Company filingNorsk Hydro, First quarter 2019 report (signed Oslo, 4 June 2019) and results release, 5 June 2019. PDF
Company filingNorsk Hydro, Third quarter 2019 results, 23 October 2019. hydro.com
Company filingNorsk Hydro, Fourth quarter 2019 results, 7 February 2020. hydro.com
GovernmentEurojust, "12 targeted for involvement in ransomware attacks against critical infrastructure," 29 October 2021. eurojust.europa.eu
PressTechCrunch, report of 29 October 2021 on the Europol and Eurojust operation and the Norwegian police link to Hydro. Cited as evidence of what was said. techcrunch.com
FederalUS Department of Justice, "LockerGoga, MegaCortex, and Nefilim Ransomware Administrator Charged," 9 September 2025 (Eastern District of New York). justice.gov
CompanyNorsk Hydro, "Update on cyber attack," 26 March 2019 (media update 14:30 CET, webcast). hydro.com
Company filingNorsk Hydro, First quarter 2020 results, 29 April 2020. hydro.com
Company filingNorsk Hydro, Third quarter 2020 results, 23 October 2020. hydro.com
ResearcherFireEye, "Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware," 5 April 2019. Does not mention Hydro; cited as the source of a Volume 1 error. cloud.google.com
CompanyNorsk Hydro, "Hydro announces new date for Q1 reporting," 12 April 2019. hydro.com
Company filingNorsk Hydro, "Operational and market update, first quarter 2019," 30 April 2019. hydro.com
PressReinsurance News, "Norsk Hydro expecting $69m hit from cyber attack," 6 June 2019. Cited as evidence of what was said. reinsurancene.ws
Company filingNorsk Hydro, "Second quarter 2019: Results down on lower realized prices," 23 July 2019. hydro.com
PressFinansavisen, "Kripos har aksjonert i Norsk Hydro-saken," 29 October 2021 (in Norwegian). Cited as evidence of what was said. finansavisen.no
Presskode24, "Kripos har klart å låse opp dataene til Hydro: - En stor seier!," 16 September 2022 (in Norwegian), citing a police statement. Cited as evidence of what was said.
GovernmentEuropol, "International collaboration leads to dismantlement of ransomware group in Ukraine amidst ongoing war," 28 November 2023. europol.europa.eu
Cite this page
BlastWave. “Norsk Hydro Ransomware Attack (2019): What Is Verified.” Hackopedia, Volume 2, FILE 010. Last verified 28 September 2026. https://hackopedia.blastwave.com/manufacturing/norsk-hydro-2019/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 010 in Hackopedia Volume 2, in the Manufacturing edition.
28 Sep 2026
Hand-check at source: the June 2019 $69 million trade report, Hydro's 21 March and 30 April 2019 releases, the US Justice Department's September 2025 release, and Norwegian reporting on the police link and the decryption keys. The keys are dated to material seized in autumn 2021, as announced in September 2022.
26 Sep 2026
Full verification against Hydro's dated releases, quarterly reports and standing page, and the Eurojust, Europol and FireEye documents. Added a further NOK 192 million insurance recognition from October 2020, narrowed the late-March recovery figures to the units Hydro named, and sourced the malware name to Microsoft and law enforcement rather than to Hydro.
24 Sep 2026
Volume 2 entry built from primary sources. Corrected two Volume 1 errors: a dollar figure printed as Hydro's cost, and FIN6 named as the attacker.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
