The bedside phone rang at 4 a.m. in Oslo, Norway. The pre-dawn call filled Torstein Gimnes Are with a drowsy sense of dread. That only deepened when he heard the first words from the other end. “We may be under attack,” said his IT colleague at Norsk Hydro, one of the world’s largest aluminum companies. Production lines had stopped at some of its 170 plants. Other facilities were switching from computer to manual operations. Bad news. It would get worse. [caption id="attachment_29985" align="alignleft" width="350"] A Norsk Hydro employee in a hard hat looks out from behind a glass door inside a factory.

A Norsk Hydro employee in a hard hat looks out from behind a glass door inside a factory.

Trond Ingelsrudøya peers from a control room at a Norsk Hydro extrusion plant. Hydro temporarily halted production at several plants in its extruded solutions divisions in Europe and the U.S. after the attack.[/caption] The breach last March would ultimately affect all 35,000 Norsk Hydro employees across 40 countries, locking the files on thousands of servers and PCs. The financial impact would eventually approach $71 million. All of that damage had been set in motion three months earlier when one employee unknowingly opened an infected email from a trusted customer. That allowed hackers to invade the IT infrastructure and covertly plant their virus. After hanging up, Gimnes Are, corporate information security officer at Norsk Hydro, immediately phoned the company’s emergency preparedness chief to organize an urgent meeting later that morning. “This was a company crisis,” recalls Gimnes Are. “IT had already shut down the network and servers to avoid any further spreading. But we didn't fully know what this was.” Soon, they all knew its name: LockerGoga, a form of ransomware. It encrypted the files on desktops, laptops and servers throughout the company. It also posted a ransom note on the screens of the corrupted computers. “Greetings!” the note began. “Your files are encrypted with the strongest military algorithms. … We exclusively have decryption software for your situation ... .” The note demanded the company pay a ransom in bitcoins and added, “The final price depends on how fast you contact us.” At the emergency meeting, Norsk Hydro executives made three swift decisions: They would pay no ransom, they would summon Microsoft’s cybersecurity team to help restore operations and they would be fully open about the breach. That third choice gained accolades from security experts around the world because it bucked the usually secretive responses many organizations employ after getting hacked. Senior staff hosted daily webcasts and answered audience questions. Executives held daily press conferences at their Oslo headquarters, posted updates to Facebook, welcomed journalists into their operations control rooms – and even launched a new company website during the attack’s first week. [caption id="attachment_29984" align="aligncenter" width="995"] A screen shot of the ransom note received by Norsk Hydro.

A screen shot of the ransom note received by Norsk Hydro.

The ransom note to Norsk Hydro.[/caption] Transparency is core to the Norsk Hydro culture, says Halvor Molland, senior vice president of media relations. By issuing frequent, candid communications about the events, the company also sought to expose the shadowy tactics of cyber criminals and maybe curb similar threats. “We wanted to help other industries learn from our experience,” Molland says. “This way, they can be better prepared for situations like this and not have to go through what we did.” In the first hours of the breach, Norsk Hydro requested assistance from Microsoft’s Detection and Response Team (DART), which goes onsite to support companies under attack and provides remote, proactive investigations. The case was designated “maximum severity,” says Jim Moeller, a DART member and a specialist in cyberattack response. He was dispatched to a small city near Budapest, Hungary, home to one of Norsk Hydro’s largest aluminum manufacturing plants. Production there was offline. [caption id="attachment_29986" align="alignright" width="500"] Three Norsk Hydro executives stand at a podium during a press conference during the cyber attack.

Three Norsk Hydro executives stand at a podium during a press conference during the cyber attack.

One of many Norsk Hydro press conferences held during the cyber attack. From left: Executive Vice President of Communication and Public Affairs Inger Sethov, Executive Vice President and Chief Financial Officer Eivind Kallevik and Executive Vice President of Extruded Solutions Egil Hogna.[/caption] Moeller spent three weeks in Hungary, building a team from regional engineers and architects. The team’s initial task was to help the company recover and reconstitute its business operations and services, Moeller says. Other DART members flew to Oslo. “With our guidance, Norsk Hydro was able to mitigate the mechanism by which the attacker was able to launch the attack,” Moeller says. They got to know LockerGoga, which also attacked Altran Technologies, an engineering consultancy company in France, and two U.S. industrial firms – Hexion, based in Ohio, and Momentive, based in New York. In Oslo, a team of internal and external forensic investigators determined that in December 2018, the hackers had weaponized one email attachment sent by a trusted customer employee to an employee at Norsk Hydro – part of a legitimate conversation, Gimnes Are says. “They equipped it with a payload to install a Trojan software on the PC of the Hydro employee,” Gimnes Are says. “This Trojan software was discovered by our antivirus a few days later. But that was already too late. By then, the attacker had built an initial foothold in our system.” At first, the ransomware compromised standard users within the Norsk Hydro computer network. Then it captured administrative credentials, allowing the hackers to command the entire IT infrastructure, Moeller says. “Once the attacker controlled the environment, they chose to deploy ransomware via a manual push from (Norsk Hydro’s) own domain controllers,” Moeller says. “This was another example of recent attack behavior where the attack group uses Advanced Persistent Threat (APT) entry strategies to deploy more commodity-level malware in the hopes of faster monetization with lower attack investment,” Moeller adds. But Norsk Hydro was not about to pay a single bitcoin to the hackers or negotiate to recover the locked files. Instead, they opted to restore their data through trusted back-up servers.