Scourge · March 19 2019

The Scourge of LockerGoga at Norsk Hydro

Chronicle

On the night of 18–19 March 2019 LockerGoga ransomware hit Norsk Hydro, one of the world's largest aluminium producers, forcing plants in several countries into manual operation. The company refused to pay, restored its systems from backups and kept the public informed with unusually candid updates and press conferences. The attack cost it about $70 million.

Lesson learned

It became the model for facing ransomware head-on: working backups, operators able to run things by hand, and transparency towards customers and markets.

Prayer of reparation

O LockerGoga, who tried to melt the servers of those who smelt aluminium, keep our backups cold and our communications as honest as Hydro's. Amen.

How it is remembered

Remembered by testing backups with real restores, training operators to work manually and deciding in advance what to tell customers and staff, and when.