Norwegian recycling giant TOMRA forced to take systems offline following a cyber attack

Norwegian recycling and mining giant TOMRA said it suffered an extensive cyber attack over the weekend that forced the company to take some of its systems offline.

TOMRA said in a cyber incident notification posted on its website that the “extensive cyberattack” was detected on 16th July and affected some of the company’s internal systems. As soon as the security incident was identified, the company said it immediately took steps to stop the cyber attack and mitigate the risk of the same.

“We immediately disconnected some systems to contain the attack, and TOMRA is currently assessing whether customers and employees might experience reduced stability in our services. Our primary focus now is to get all systems up and running again as fast as possible,” the company said.

TOMRA has notified all relevant authorities about the incident and has deployed “all available internal and external resources” to neutralise the incident.

The company has so far not shared much information about the nature of the cyber attack, whether any data has been stolen from its internal systems, or how the threat actors infiltrated its network.

TOMRA, however, said that many of its systems are still offline and it is working round-the-clock to resolve the situation and get its systems back online when it is safe to do so.

“Our primary aim is to continue to deliver our services to customers, reducing the impact this attack has on them. The attack currently has a limited impact on TOMRA’s customer operations. Most of TOMRA’s digital services are designed to operate offline for a certain amount of time but may have reduced functionality in the interim.

“A team is working to establish temporary solutions for all digital systems to support keeping customer solutions operational over time,” it said.

The company added that TOMRA Recycling and TOMRA Food are operating as usual, but the reverse vending machines (RVMs) in Europe and Asia are operating in offline mode with a limited number of old RVMs that are not working.

It added that some of its internal IT services and back office applications are still offline and the forced downtime has affected the company’s supply chain management. Several significant office locations are offline, and employees have been asked to work remotely.

The company has, however, confirmed that it will “remain transparent with all stakeholders” and share updates as and when available.