There everyone here in Oslo, and there, all of you following us on webcast. Welcome to the second update of the situation for Hydro following the cyber attack. We will give you an update, and then we will have a session with questions and answers afterwards. In the end, we will have time for one-on-ones for those who wish that. We're trying to be as transparent as possible in this very complex situation. Although we don't have all the answers, we'll do the best we can. We'll start with our CFO, Eivind Kallevik, who will give us an update. Eivind.
Thank you. Thank you, Inga, and good afternoon, everyone. Yesterday was a hectic day for all of us in Hydro, with considerable uncertainty throughout our global organization, and how this malware could impact our people, business, as well as customers. I would therefore like to start today with congratulating our 35,000 people, spread across 40 countries, and throughout five different business areas and corporate staffs for responding to this attack with extreme professionalism, speed and determination. An enormous collective effort has been carried out the organization, with the aim to ensure safe and stable operations. We would also like to take the to thank all the relevant authorities for their support and agility in this situation.
We have today reported the cyberattack to the Norwegian police, Norway's National Criminal Investigation Service or Kripos, and police have now opened an investigation into the matter. We don't have a fixed timeline on how to restore and stabilize all our systems, but we are pleased to report that we have progress overnight. The critical development for us has been the detection of the cause, which is a prerequisite for us to start working on our plan and process to safely restart our IT systems within Hydro. This work is now happening as we speak. As reported yesterday, Hydro, immediately after detecting the problems, started the work to isolate plants and operations and procedures and finding alternative methods to extract customer orders to allow for continued operations.
For our people, this attack is causing considerable uncertainty and inconvenience by creating extra efforts and manual operations as computers and systems remain unavailable. The commitment to solving the situation is impressive and demonstrates the competence and dedication by our employees around the world. The main priority for us continues to be to ensure safe and stable operations, limit the operational and financial impact, and continue to serve our customers as planned and agreed. As such, it is too early to estimate any operational and financial impact on this incident. From this overall perspective on where we are on our 24/7 operation and efforts to combat this ongoing cyberattack, let me then provide you a quick overview of where we are in the individual business areas. In Bauxite & Alumina and Energy, we are running and continue to run our production as normal.
If we look to the Primary Metal plant, the production is also here running as normal, with somewhat more manual operations still in place in the different plants in Norway. Within Rolled Products, we still have some degree of inabilities to connect to the production systems, so far, they've caused very limited operational impact. We do plan to restart some of these systems during today, and this will allow us to extract customer order and data to continue deliveries as expected. Within Extruded Solutions, we see the same technical issues. We have some issues connecting to the production systems, which has created some challenges and some stoppages at some of our plants in Europe and the U.S.
Also here, we will restart some of the systems during today, again allowing us to take out production orders, customer orders, again fulfilling the production of the commitments we have towards our customers. Thank you. Inga, back to you.
Thank you. We open for questions and here from the audience in Oslo, and we've also opened for questions from the webcast. Are there any questions from you?
Just, if you could elaborate.
Yeah. Please wait for the microphone so it's possible for. Introduce yourself, Reuters.
Reuters. Could you please elaborate a bit on, where are you still experiencing stoppages, as you said now?
We are still experiencing some stoppages within Extruded Solutions at some of our plants in Europe as well as in the U.S. We are then planning to restart some of the production systems during the day, enabling us to pull the customer data and the orders that we have, so we can fulfill them in the days to come.
Jakob from Dagens Næringsliv. Can I do it in Norwegian or do I have to?
It's good if you do it in English now, and you can do it in Norwegian later.
Okay. There has been an amount of money related to threat. Can you say anything more about the, yeah, the amount that has been demanded? I had a second question as well because we have a story today with the CEO of Visma who experienced a similar attack last year. He says, quote, that, "A large and important company as Hydro should not be as vulnerable for an attack. attacking the whole organization like this." Do you have any comment to that?
When it comes to amounts, this is ransomware, as we have explained. We have not received any claim for any specific amounts, and that is not our base case in terms of how we will get back and restore full operations. The plan, the base case and the strategy is to get back to operations by cleaning.
Mm-hmm.
the systems we have, restoring the data we have from our backup systems. When it comes to the comment from the head of Visma, that should stand on its own accounts. I will not comment any further on that.
Hi, I'm Line Tomter. I work in NRK, the national broadcasting company. I assume you're going through the logs now, and I wonder, do you know anything about how, for how long they were in the system before you discovered they were there? Do you know anything about what kind of systems in Hydro they were visiting during this time?
Yeah. This case is now under police investigation. I will not go into details on where in the system and potentially for how long they've been there.
Just can you confirm they were in the system, a time before you discovered it?
We can confirm that the first time we received or noticed irregularities in our systems was just after midnight on Tuesday night. The night from Monday to Tuesday.
Thank you. Yeah.
My name is Birgitte Iversen. I come from the NTB National News Agency. The national security authorities said today that Hydro, you were not connected to the national surveillance system during the attack. Why weren't you connected at the time? What impact do you think that had on the scale of the attack?
Yeah. It's not possible to evaluate what kind of impact it would have had. We still had significant monitoring activities on the nodes we have to the web, both through our own internal resources and through external support from other providers of such services other than NSM. That being said, we still have good and open communication with NSM also during this process.
Microphone. You mentioned that you said before that you also hired an external advisor to help to clean up your systems. Could you name the company which you hired?
So far we have not gone out with a name, and it's not one company. We have several companies supporting us in the work that we're currently conducting.
Any questions from the webcast?
Few questions from Menno Sanderse, Morgan Stanley. Has ransom been paid?
No ransom has been paid.
Have there been any structural damage, damages, as a result of the attack?
No. Through the work we did, yesterday by isolating, the different plants and systems that we've had, we've been able to keep all operations, with some smaller exceptions as mentioned, up and running. When we get to clean the systems from the virus, where we found the virus signature so we can start that work, we will then restore full operations based on the backup systems that we have.
Far it seems to be modest impact on shipments and production. How long will it take before the impact to become material?
So far we're delivering according to plan. We will access more of the production systems today. Been unavailable yesterday partly. That will give us more days of visibility in terms of supplies of material to our customers. With the information today, we are quite optimistic that that will remain the case also going forward.
Question from Jason Ferkler, Bank of America, Merrill Lynch. It's early days to talk about financial consequences. Are you actually losing business because of the situation?
Far we have no indication that we are losing business. We are delivering on the orders as we have promised to our customers and contracted a long time before this incident. That's still going on as planned. It's too early days to conclude on any financial impact on this. That is something we have to come back to at a later stage.
A question from several on webcast. Can you provide more details on the cyber insurance, the coverage and whether it includes business interruption?
I'll be careful in going into the details of the insurance coverage. We have a good and strong cyber insurance policy in place with reputable international insurance firms. They do cover business insurance or business interruptions as such.
Okay. Yes. Jenny Rødal, Dagbladet. Do you know why you were not connected to the system, to the security system?
This was a conscious decision, which when this was done, was then replaced with other monitoring equipment in this period.
One more question from DN. Do you have any more information about the attack and the origin of the attack? Which country? Which kind of people is behind this?
This case is now currently being investigated by Kripos. We cannot go into any details on the technical side, on the cyberattack as such.
As far as I understand, Fujitsu was in charge of, ensuring your cybersecurity.
We have several players who work with us in terms of ensuring our cybersecurity, but I will not go into the details of who those are at this point in time.
Was Fujitsu the main contractor?
Fujitsu is a long-term contractor for Hydro. For cybersecurity, I will not go into details as to who has been providing that service.
Okay. Any other questions from here or webcast? No. I will leave it to that and say thank you very much for joining us and see you again soon. Thank you.