Welcome, all of you in Oslo, and also welcome to all of you following us on webcast. As you have been informed today, Hydro has been subject to a cyberattack. In that respect, we have now called for a meeting with the media and also for analysts here in Oslo, but also on webcast, in order for you to get an update of the information and also to be able to ask any questions that you might have. With me, I have a CFO, Eivind Kallevik in Hydro, who's also the leader for Hydro's corporate emergency team. Also I have with me, Bente Hoff, who is a Director of Cybersecurity in the Norwegian National Security Authority. With her Communication Director, Mona Strøm Arnøy.
With that, I give the word to you, Eivind.
Thank you, Inga, and good afternoon, everyone. Around midnight Norwegian time, our IT experts noticed unusual activity on our servers within our global IT systems. Through this, we uncovered that Hydro was subject to a serious cyberattack. As the attack was spreading throughout our business, we did take measures to contain and neutralize the attack. This virus is a so-called encryption virus, or also commonly known as ransom virus or ransom attack. We have now isolated all our plants and operation, and is switching to somewhat more manual operations and procedures, as far as possible throughout the operations. It's also important to mention that the attack has so far not had any safety-related incidents attached to it. If you look to the operational status of the plants, the impact on the different business areas are now as follows.
Within the energy department, the production is running as normal. Bauxite & Alumina in Brazil, production is running as normal. In Primary Metal, the primary plants in Norway are running as normal, although with a somewhat higher degree of manual operations. We have no indication that the primary plants outside Norway have been hit by this virus. Within Extruded Solutions and Rolled Products, there is a lack of ability to connect to the production systems, causing some production challenges and temporary stoppages at several plants. Let me be clear. The situation for Hydro through this is quite severe. The entire worldwide network is down, affecting our production as well as our office operations. We are working hard to contain and resolve the situation and to ensure safety and security of our employees.
Our main priority now is to ensure safe operations and limit the operational and financial impact. The incident so far, as I mentioned, has not led to any safety-related incidents as of today. We are of course also doing all we can to minimize the impact that this has on our customers. The relevant authorities have been notified and are supporting Hydro in investigation and resolving this problem. We are already internally organized to work 24/7 until this situation has been resolved. Hydro has extensive internal IT competence within its global IT organization, we also engaged external expertise to support us on this critical task of containing and resolving and neutralizing this serious attack. With that, I will leave the word to the Norwegian National Security Authority.
Thank you. The Norwegian National Security Authority, we were contacted by Hydro this morning. Our role in this setting is to support Hydro, to reduce damage and get back to the normal situation. We're supporting with competent resources, doing analysis and getting an overview of the situation. We are also using our contacts nationally with other authorities and also internationally to get the information, we need in this situation and also to share as what's needed to get information back. Thank you.
Thank you very much. With that, we open for questions. Are there any questions? There will be a microphone for you if you have questions that Halvor will pass around. There is a question here on the second row.
It's Sigbjørn of Aftenposten. Can you describe the situation, how it has developed during the day? Has there's been improvement, or has the situation worsened for Hydro?
What we spent, a big part of the day has been really to isolate the different plants to ensure that the virus doesn't move from one location to another. That operation is now concluded. All plants are now isolated from the global network. Secondly, what we have been working on is obviously identifying the virus, giving them the traces of the virus that we find to give it that to our internal experts, but also external experts to find what you can call a cure for getting this virus out of the system.
You say you isolated the virus, and you find what kind of virus this is?
We have isolated all the plants, so we ensure that there's, the virus cannot move from one system or one plant to another. We have identified that this is an encryption virus, which still needs to be analyzed and corrected.
What's the most critical point at the moment?
The most critical point for us at the moment is to find a cure for the virus so we can ensure that we can find any servers which are attacked by the virus and clean those servers to get operations back to normal. As I mentioned, it is important to say that most of the operations we have today are also running as normal with somewhat higher manual operations compared to a normal operating day.
NRK.
Thank you. Peter Svaar from Norwegian Broadcasting. I have a few questions. Are there any sort of unsalvageable data that has been encrypted, or do you have backups of everything so that it will be possible to get the data back? Second question, are you considering paying up to those who are holding you ransom, or is that completely out of the question?
We have good backup solutions, and good routines for that in the company. That is the main target for how we will get the operations back to normal is to reinstall the data we have from the last backup data, and that is recent.
Are you considering paying ransom, or is that completely out of the question at this point?
The main strategy is to use the backup data that we have in our system to restore operations to normal.
Can you indicate how, to what extent your global operations have been affected by now? I mean, how much is it affecting production? What are your daily losses?
As of today, the, those losses are minimal. Then obviously, the longer the virus is active and not isolated and cleaned up, there will be an impact. Importantly, as of today, energy is running as normal. Bauxite & Alumina in Brazil is running as normal. Primary Metal is running as normal. There are some stops on the downstream side in some of the plants.
Any other questions? Yes, Bloomberg.
Which plants have been affected within Extrusion and Rolled Products?
Within Rolled Products, we have some smaller stops in the cast house at Holmestrand, for instance, which was stopped for a little for a bit of time. It's now back up and running. We are currently producing all the orders that we have control of through printouts of lists of what the customer has ordered. That's being produced today and will be continued to be produced during the rest of the shifts today. Obviously here it is important for us to get the operational systems back up and running so we can get access to the customer orders.
Reuters.
Just to clarify, are you able to deliver to your customers? Do you have the, do you know which product is going to which customer?
As of today, we are.
Sorry, just to follow up. Can you explain what's the impact of running a facility on a manual basis?
It means that we need to add more people on the different shifts. Remember that plants, if you go back three, five, seven years, were run with much more manual capacities than they are today. These are practices that we have a culture of doing internally in the company, despite the fact that we haven't used them for some time. This still means that we can run operations in a safe and secure manner.
[audio distortion]. For how long do you think this will be a problem to solve the virus?
That is very hard, it's very hard to have a precise answer to that. The different stakeholders we have working with us is working on that challenge at the moment. We cannot pinpoint exactly when it will be resolved.
Have you contacted PST or Kripos?
As I said, explained, we are helping Hydro in this, and we are also having a very close cooperation with PST, Kripos, and the intelligence service through established channels. They're all involved in this.
Do you know the identity of the hackers?
No, we do not.
Tor Henning Ueland, Dagbladet. Just to follow up on the orders, question earlier. Do you have any, estimates on if future orders will have, problems being delivered?
It varies from plant to plant in terms of how much disability we have today. We also see that we have achieved during the day to have some workarounds into the administrative system so we can actually pull the orders, then extending the disability. It's too early to conclude. The main target is to find, in a way, the resolution or the cure for the virus and then restore operations based on the backup solutions we have in place.
Do you suspect, you fear that future orders might become a problem, say, if it takes a couple of days?
I will not speculate whether this is a couple of days or the time period for it. What we have today is enough visibility to keep on production delivering the go-goods and products that our customers have said or ordered.
Can you confirm that this is the LockerGoga virus?
Right now we are working on several hypotheses and theories, that's what we always do at that stage in a case like this. Now we are working towards with the several theories, and that's one of the theories.
Any other questions? Yeah. Bloomberg.
Customer orders will not be affected right now, but for how long can you meet those orders with this situation?
It varies from plant to plant. Again, what we are working on is two ways to find a resolution for the virus, clean up the systems, and get the production systems back up based on the backup solutions. We also see in some of the plants that we are able to do workarounds in the existing systems, looking into the backups to get the orders out. That of course, is critical for us to continue to produce and sustain good deliveries of high quality products to our customers.
How are the operations affected in U.S., compared to Europe? Has the whole company been attacked?
The whole company is affected by this situation. Of course, we have many plants in Hydro. Some are hit harder than the others. This started in the U.S., some of the plants in the U.S. are out of operations on certain parts of their activities, but not all of them.
Do you have any insurance for any damages?
We have a cyber insurance, yes.
Okay. Any other questions? Yes,
Aftenposten.
As far as I understand, you have been running the whole day without computers in the company. You were not able to use the computer. How has it been to run the company during the day like this?
We are still using computers, and certain parts of the operational computers that we operate in. We still continue to operate main systems through tablets and telephones. It's still possible to work in a 2019 mode for many parts of our operation.
Okay. Another one here. Reuters.
How many computers are offline?
Aston, is that something we.
I don't think we know this. First, because, again, we operate something, yeah, locally and something on the system.
The tablets and the phones are working?
Yes.
The computers are not.
Okay.
We're still communicating through email, through our phones.
Yeah, yeah. you know, is it all computers in the office are completely down?
I think it's impossible to give a completely precise answer. We're 35,000 people throughout the company, divided in 40 countries. I can't really tell you if 1 computer is on or off. Yes.
Have they asked for money through Bitcoin or something like that?
Typically, what you will find in ransomware is an open text file, asking to make contacts. As I said, our best case is to restore operations based on the strong backup routines we have on production and data.
What sums are we talking about?
No sums have been mentioned, and it's not something I would speculate in.
Okay. If there are no further questions, together, I will say that we are trying the best we can to keep you, also our employees and the world around us, updated as we have information coming. We will call for further updates in due time. Then we would open for one-on-one interviews. I would like to arrange that so that you, if you have questions for the security authority, go to this side of the room, and for Hydro in this side of the room. Thank you very much for joining us. Thank you