Norsk Hydro
Norwegian aluminium producer hit by LockerGoga ransomware in March 2019.
Norsk Hydro refused to pay when LockerGoga ransomware hit its global network in March 2019, restoring from backups at a first-quarter cost of up to 450m Norwegian kroner while keeping the market updated throughout.
Last refreshed: 12 October 2026
Why did Norsk Hydro refuse to pay its ransomware gang?
Timeline for Norsk Hydro
Named as Norsk Hydro
Cybersecurity: Threats and Defences: Mentioned in: Boston Scientific likely to miss guidanceBackground
Norsk Hydro, which now trades as Hydro, is a Norwegian aluminium producer that also operates power plants.
In March 2019 the LockerGoga ransomware spread across Hydro's global network. Some Hydro plants stopped, others switched to manual operation, and the extrusion business took the heaviest blow. Hydro said it would not pay the attackers and rebuilt from backups. It estimated the first-quarter cost at up to 450m Norwegian kroner, about $52m, held cyber insurance, and pushed its quarterly results back by five weeks.
Hydro kept investors informed with regular updates, and its production losses stayed contained. That record makes Hydro a counter-case to companies whose cyber outages grew into longer supply shortfalls, such as Boston Scientific, which warned in September 2026 that an August network outage would likely cost it its sales and profit guidance.