Norsk Hydro's cyber-attack: running by hand, telling the truth daily

In March 2019 malware paralysed the computers of a Norwegian aluminium group that ended the year with more than 36,000 employees (Norsk Hydro ASA, 2020). The question for a business owner: if your systems went down for a week, what could run by hand, and who would tell customers what, and when? This post reads two public sources on Hydro, the 2019 annual report and a case study, beside the five processes of high-reliability organising.

What happened, according to Hydro's own report?

On 19 March 2019 Hydro suffered a major cyber-attack. It affected the entire organisation; the Extruded Solutions business area had the most significant operational challenges and financial losses. The other four areas (Bauxite & Alumina, Primary Metal, Rolled Products and Energy) produced close to normal, though based on work-intensive workarounds and manual procedures, says the report (Norsk Hydro ASA, 2020). The main financial impact was lost sales from being unable to produce, or to receive and process orders, for a period in March and April, plus the cost of remediation. The total estimate is NOK 650 to 750 million; Hydro had cyber insurance and recognised NOK 216 million of compensation in 2019 (Norsk Hydro ASA, 2020).

The recovery is described quite concretely: all PCs and servers across the company were reviewed, cleaned and restored under strict guidelines, and encrypted machines were rebuilt from backups. Hydro then reorganised its security team to detect and respond to incidents better, and educated employees on secure ways of working. The report adds that these measures may still prove inadequate to prevent attacks (Norsk Hydro ASA, 2020).

What did running by hand look like in practice?

The case study by Salviotti and colleagues rests on accounts by Hydro's head of communication, its security chief and its information director, taken from one webinar and two podcasts; the authors could not interview top management (Salviotti et al., 2023, p. 6071). From those sources:

• The attack was discovered in the US just after midnight before travelling to Hungary, where Hydro's IT infrastructure centre sits. Around 3 am the head of infrastructure independently decided to shut down 23,000 PCs and 3,000 servers (Salviotti et al., 2023, p. 6072).
• Staff took systems back to manual production, and many lines had to stop (Salviotti et al., 2023, p. 6071). Two days later, according to the paper, Extruded Solutions was running at nearly 100% and Rolled Products at about 50% of normal capacity (Salviotti et al., 2023, p. 6072). The annual report does not give day-by-day figures and says Extruded Solutions was hit hardest, so the two sources do not line up and I would not rely on those percentages.
• With normal channels gone, they used WhatsApp and handwritten posters internally, and Facebook and Twitter externally. Hydro's CyberHeroes campaign included former employees brought back to help create manual operations, and an employee called Jan, a technology pessimist who had printed out all orders and specifications over his years at Hydro, so he had everything on paper (Salviotti et al., 2023, p. 6073).

The point to keep is that on cybersecurity Hydro was not well prepared. The study records that before 2019 the company lacked security measures, had weak endpoint security, a suboptimal architecture and insufficient data backups, and that top management neglected cybersecurity (Salviotti et al., 2023, p. 6072). Communication was different: the security chief said communication is part of the crisis team, and that this was something they had prepared and trained for (Salviotti et al., 2023, p. 6073).

Transparent communication: what did Hydro do, and according to whom?

By the head of communication's account, the principles "proactive, transparent and frequent" were decided at 7 am on the day, top management issued a stock-exchange release before 9 am, and by 3 pm the first external webcast was held (Salviotti et al., 2023, p. 6072). Internally, every morning at 9 am there was an update, even with nothing new to say; employees could ask questions; the session was recorded and put on the news app for colleagues in other time zones. The head of communication stressed plain language and humour (Salviotti et al., 2023, p. 6073). With around 30,000 customers, they chose frequent and direct updates; the head of communication says customers were pleased to be told from the start, so Hydro "lost very few" (Salviotti et al., 2023, p. 6073).

Aoyama and colleagues (2019) also analyse the case. The abstract says Hydro combined traditional media and social media with frequent updates on the attack, and the authors suggest that agility, transparency and positive reinforcement were the success factors (Aoyama et al., 2019). I read only that abstract.

Weigh how strong the evidence is. Both sources rest mainly on Hydro's own account and public information. "Lost very few" is the head of communication's statement; the sources I read contain no independent customer data. The case study also says the share price rose after the event, citing a news article (Salviotti et al., 2023, p. 6071); the annual report records that Hydro's shares closed 2019 at NOK 32.64, a return ex dividend of negative 17%, in a year that also had production restrictions at Alunorte and a weakening market (Norsk Hydro ASA, 2020), so I do not use the share price as evidence about communication.

How do the five processes of high-reliability organising apply to this case?

The site's framework lists the five processes of collective mindfulness that Weick and colleagues (1999) describe for organisations where small errors can cause disasters High-reliability organising (five processes). I have not read the original, so the table is my reading, pairing each process with a sourced detail.

Two cautions. There is only one person doing the pairing: me, without checking against anyone else, and the details come from one group of sources. And the case study uses a different framework, by Wooten and James (2008), not these five processes.

What if your systems went down for a week?

This checklist is my inference from the Hydro case, not tested on small firms. Each row is tied to a detail from the case.

I think this works if you do it once, in half a day, with the person in charge of operations and the person in charge of systems. It does not replace prevention: Hydro was still attacked, and the case study treats earlier ignorance of the risk as a factor that increased its exposure (Salviotti et al., 2023, p. 6074).

Going deeper: what did I read, and what did I not?

Hydro's 2019 annual report is the company's own document; I read the passages on the attack, its cost, the compensation and the recovery, not the whole report. I read the case study by Salviotti and colleagues (2023) in full (open access); its main data are three secondary interviews with Hydro managers plus public documents. It gives a cost of NOK 400 to 450 million, lower than the 650 to 750 million in the annual report; I use the report's figure. It also gives two slightly different figures for affected machines (22,000 computers in one passage, 23,000 PCs and 3,000 servers in another), so I cite only the shutdown figure at 3 am and say it comes from an account.

I read only the abstract of Aoyama and colleagues (2019), as the conference paper is behind a paywall. I have not read the original paper by Weick and colleagues (1999) on the five processes; the table above rests on the library framework's description, and no independent source in the library covers the details of Hydro's response.