For Q1, Norsk Hydro puts the overall impact at between $35 million and $40 million (NOK 300 – 350 million), of which between $29 million and $35 million (NOK 250 – 300 million) is related to Extruded Solutions.
For Q2, the firm puts the overall impact of the cyber-attack at between $29 million and $35 million (NOK 250 – 300 million), of which between $17 million and $23 million (NOK 150 – 200 million) is related to Extruded Solutions.
This results in an overall expected hit from the cyber-attack of between roughly $64 million and $75 million (NOK 550 – 650), which, at the upper end of the range is approximately $6 million higher than the potential $69 million impact the firm announced in June as part of an investor report.
In its second-quarter 2019 financial results, Norsk Hydro states that as at the end of the second-quarter, operations have largely returned to normal, adding that it expects a limited financial impact from the cyber-attack in the third-quarter.
After detecting unusual activity on its servers that disabled part of its smelting operations, Norsk Hydro isolated all plants and operations and switched to manual operations and procedures. Initially, the firm said that the attack could cost as much as $41 million, with this figure rising to $52 million April and then to $69 million at the start of June.
With the latest estimate at a larger $75 million, it’s clear that assessing the financial impacts of cyber-attacks is challenging and complex for companies, something that is hoped will improve in time as more breaches occur and more comprehensive data is available to be analysed and utilised.
The attack was suspected to be a form of ransomware called LockerGoga, which utilises an unusually disruptive hacking approach that can cause “chaos” for the industrial firms that it targets, according to cyber experts.
In its Q2 earnings release and accompanying presentation, Norsk Hydro reiterates the fact that it has a “robust cyber insurance policy in place with recognized insurers.”