LockerGoga
Ransomware that hit Norsk Hydro and industrial firms in 2019.
Set against Boston Scientific's 8 September 2026 profit warning after a network outage, LockerGoga is the opposite case: Norsk Hydro ran its plants by hand through the March 2019 attack, refused to pay and briefed markets daily.
Last refreshed: 12 October 2026
How did Norsk Hydro keep running through LockerGoga in 2019?
Timeline for LockerGoga
Mentioned in: Boston Scientific likely to miss guidance
Cybersecurity: Threats and DefencesBackground
LockerGoga is ransomware that struck the aluminium producer Norsk Hydro on 19 March 2019. Norway's National Security Authority identified the strain, according to Recorded Future, which named the French engineering firm Altran as an earlier victim.
Hydro says the attack reached its whole organisation. Its plants kept working on manual procedures, it would not pay a ransom and it updated investors every day; it puts the total cost at about 800m Norwegian kroner.
Eurojust said in November 2023 that police had arrested, in Ukraine, the ringleader of a group using LockerGoga, MegaCortex, Hive and Dharma. US prosecutors charged an alleged LockerGoga administrator in September 2025.