Nordic companies targeted in wave of cyber attacks

The virus attack against NCH, the Nordic region’s largest hotel and leisure group, was launched on 2 December. The hackers managed to paralyse, infect and encrypt an undisclosed number of machines, forcing NCH to accelerate the pace of a newly rolled-out project to convert more than 4,000 computers using Microsoft Windows to run on Google Chrome OS.

NCH’s technology unit, working with internal and external IT cyber security experts, managed to convert 2,000 computers to Chrome OS within 24 hours of the attack, enabling the company to maintain basic operations such as bookings, check-in and check-out, and payment solutions.

“We were already engaged with the pilot project to convert our Microsoft Windows computers to Google Chrome OS when the attack happened. We decided to re-focus resources to speed up the Chrome OS project, which is linked to our cost-efficiency and CO₂ reduction programmes. We were able to clean all machines of the virus and install Google’s CloudReady solution,” said Kari Anna Fiskvik, NCH’s vice-president of technology.

Obtaining forensics support from the Norwegian National Security Authority (Nasjonal Sikkerhetsmyndighet), NCH was able to identify the computer virus as the work of the so-called Conti ransomware group. Bjørn Arild Wisth, NCH’s deputy CEO, said the company took a decision not to contact or respond to any ransom demands. 

“Over the weekend of the attack, we managed to implement alternative solutions at most of our hotels. The aim was to return staff to normal operations, a goal we achieved within days of the cyber attack,” said Wisth. “Our forensic investigations do not reveal, currently, that data from the attack has been leaked, but we can’t rule it out.”

The Conti ransomware, which was first observed in 2020, is particularly aggressive towards all versions of Microsoft Windows. Having breached an IT system, the Conti virus will attempt to delete Volume Shadow Copies and terminate important services using Restart Manager to enable it to encrypt files. Conti is also purposed to uninstall the Windows Defender application on computers.

NCH estimates that its decision to change the software instead of the hardware on its IT network, which comprises 4,000 computer machines, will save the company around NOK60m (€6m).

The cyber strike against Nortura on 21 December forced the Norwegian meat processing company to shut down its entire IT system ahead of a forensics investigation and the cleansing of computers connected to the company’s central IT system.    

Nortura detected the attack at an early stage and was able to limit damage to its IT system by shutting down internet access, said CEO Anne Marit Panengstuen. The swift action prevented hackers from capturing data or encrypting operating system files.

“Cyber threats are becoming more common generally and we keep investing to protect our business against bad actors. We have good contingency plans, which were activated when we became aware of the attack,” said Panengstuen. “We also had an element of luck on our side as we had conducted an IT cyber security contingency exercise in 2021 that was based on a similar threat profile.”

“Cyber threats are becoming more common generally and we keep investing to protect our business against bad actors. We have good contingency plans, which were activated when we became aware of the attack”