"This is perhaps the first hacker attack that has directly affected the raw material market," says Håkon Lønmo, a cyber expert and ethical hacker in IT, an audit and advisory giant of the BDO.
– If you stop production in a large company such as Norsk Hydro, it will directly increase the price of the raw material they produce, and if you know that there is good money in advance, says E24.
The market results came after the attack, which for the first time gave him the idea that a cyber attack could be a successful attempt to influence the prices of aluminum.
On Tuesday, March 22, when Hydro announced that it had experienced a major cyber attack, the price of aluminum increased by 1.30 percent to its highest level in three months, says Reuters.
In addition, the Hydro share decreased by 2.26 percent immediately after opening the Oslo Stock Exchange, but slightly decreased.
Maybe it brought a big profit
Strong people or groups who knew in advance about price movements could benefit from trading in raw materials and stocks – probably more than the profit they could claim when buying, which often ranges from around 25,000 to 5 million crowns.
– The motive for the attack could have been the impact of the share price and the price of raw materials for aluminum. The financial profit to know about these market changes in advance can go beyond ransom, says Lønmo.
In addition, it is relatively likely that a hacker attack has been bought and ordered by a money-rich person or group that would earn money on financial markets, while hackers would only carry out the mission.
– Those who have enough capital can reserve this by starting a dialogue with hackers and ordering a cyber attack in the same way as you can order murder.
Read also: Hydro: A conscious choice not to participate in the national alert system
Cyber attacks often "complicated"
A cyber expert adds that the myth is that hackers often work alone in a dark room.
– I do not think people understand how complex and creative these events are. Rarely a single hacker works alone from a dark room – there are often different groups that plan, develop, execute and, ultimately, order a hacker attack. We have to think that unexpected examples and motives can be.
For example, two years ago, he handed over a hacker attack in a casino where a cyber attack occurred over an aquarium that is linked to the "Internet of Things" and thus to the rest of the system.
If Lønm's theory is correct, it will not be the first time that a hacker group has an impact on the financial markets.
In 2015, 32 merchants generated around 852 billion NOK trades after hackers stole more than 100,000 stock exchanges before they were published.
In addition, the last year's report showed that data breaches negatively affect companies that are affected – on average, the company's share decreases by 2.89 percent and reaches a bottom approximately 14 days after burglary.
Read also: Hydro on the attack data: – Satisfied that you are insured
The goal was Hydro
Hacker's choice of LockerGog virus supports the theory that it was intended to influence markets.
First and foremost, it is clear that Hydro was designated as a target when the attack was carried out, but it is usually only randomly attacked.
– The victim was manually planted by someone with administrative access. So there is no doubt that the attack was directed at Hydro. The product for damage also has destructive properties. This means that it is designed to create congestion. These two factors increase the likelihood that this was a successful attempt to influence the share price and the price of aluminum, says Lønmo.
– It often becomes "shoot and see what hits" when it comes to hackers. They test a group of companies and get about 10 percent of the companies, but not in this case.
In addition, aluminum is the best-selling product, which makes the raw material a natural goal, since high price movements can lead to a "short slice" – something that happened on Tuesday when news broke out.
Norsk Hydro would not comment on the intentions of hackers.
– We are only concerned about getting all systems back, says Halvor Molland, contact person E24.