NEWS AND EVENTS
02:31. When production stops – and no one knows why
By Nina Hesby Tvedt, Chief Technology Officer
Here is a scenario that, unfortunately, is closer to reality than fiction for many industrial operators.
It is 02:31, and a production line at a food manufacturer has stopped. No alarm has sounded, no one has reported a fault, and there is no open maintenance order. The line just isn't running.
The first suspicion is mechanical. Engineers start checking conveyors, controllers and process equipment. Maintenance is called in, suppliers are phoned, and production managers spend the next few hours trying to work out whether they are dealing with a technical fault, a supplier problem – or something worse.
Eventually a likely cause emerges. A few days earlier, during a remote maintenance session, a small configuration change was made inside the operational network. It looked harmless at the time. Nothing raised an alert, nothing flagged it, and no one had real insight into how the change affected the production environment. The problem only became visible after operations had already been disrupted.
For many industrial operators, this story is not hypothetical at all. They have lived a version of it themselves.
Cybercrime has become a commercial success - and Scandinavian businesses are being hit
In April 2024, Norrmejerier, one of Sweden's largest dairy cooperatives, had to shut down its main production plant in Umeå after a cyberattack knocked out critical production systems during the night before 16 April. The plant was down for approximately sixty-four hours. Milk deliveries were rerouted to other dairies, and some raw milk could not be processed in time and had to be discarded. Losses ran into millions of Swedish kronor. The incident illustrates how regional food cooperatives, far from any geopolitical front line, are now part of the threat landscape.
Nor is the pattern new. On 21 December 2021, Nortura, Norway's largest meat producer, detected suspicious activity on its servers and halted production as a security precaution. Slaughtering stopped during the Christmas period, farmers had to postpone livestock deliveries, and stores ran short of products. The financial loss reached tens of millions of Norwegian kroner. No ransom was ever demanded, and no malware was confirmed to have reached the operational systems. Production stopped anyway – because when you cannot trust the environment, stopping the line is usually the only safe choice. The same group was hit again in 2024, when attackers compromised the email of a chief executive at Nortura-owned Hå Rugeri AS and diverted close to one million kroner through a fake invoice. The threat surface extends far beyond the production floor.
In 2022, Arla Foods experienced an IT outage at its plant in Germany that disrupted logistics and production at the facility. Production does not always have to be hit directly – it stops anyway, because the systems that plan it, route it and verify its quality go down with everything else.
Looking at the region as a whole, the picture is hard to ignore. Norsk Hydro's LockerGoga incident in 2019 forced aluminium smelters into manual operation and cost the company an estimated 600 to 800 million kroner. Demant, the Danish hearing aid manufacturer, took a loss of around 550 million Danish kroner the same year after hackers caused a global production and distribution outage. Moelven and Coop Sweden have also appeared on the same list, and the outcome repeats itself: production stops, regardless of whether OT itself is the point of entry.
What these incidents have in common is not a particular threat actor or a specific piece of malware. It is the underlying vulnerability.
Silent exposure
Today's production environments are far more interconnected than they used to be. External supplier access, system integrations, cloud connectivity and an ever-growing number of digital touchpoints have made operations more efficient. They have also created a larger attack surface with many blind spots. In many organizations, changes inside the OT environment happen silently, with limited oversight, and only become visible when they start to affect production, quality or safety.
A brief clarification of what OT actually means in this context: Operational technology covers the systems that directly control industrial processes – programmable logic controllers, SCADA systems, industrial endpoints, sensors and the communication networks that keep production running. Unlike IT, OT is built around uptime. When OT goes down, the consequences are immediate and physical. Production stops, processes become unstable, product quality can be compromised – and in the food industry in particular, food safety can ultimately be at stake.
The difficult part is that many organizations still lack good insight into what is actually happening inside their OT environment. They are not always sure which assets are connected. Unauthorized devices can appear unnoticed. Unusual traffic between systems goes unflagged. Configuration changes on industrial controllers happen without anyone really tracking them – and when something goes wrong, it is hard to determine whether it is a technical fault, a supplier error or a genuine security incident.
That uncertainty is where operational risk grows.
Insight before it turns into downtime
SecureNOK addresses this with the SNOK platform, which is purpose-built for industrial environments. The platform monitors OT networks, endpoints and PLC environments without disrupting operations. It builds an asset overview, continuously monitors network behaviour, detects anomalies and flags changes that would otherwise slip by.
What the platform really gives operators is something many industrial organizations lack today: a clear picture of what is connected, what has changed and what unusual activity is under way – before any of it develops into downtime.
In practice, this means organizations can see what happened and why, with enough warning to actually do something about it.
This is becoming increasingly important as regulations tighten. Under the NIS2 Directive, operators of critical and important infrastructure are expected to strengthen their cybersecurity governance, improve incident detection, tighten supply chain oversight and carry out continuous risk management across operational systems. For companies running industrial production environments, compliance increasingly means being able to monitor and manage OT risk in a structured way – not reactively.
The question no one wants to answer
That leaves production managers with an uncomfortable question.
Do you actually know what is happening inside your OT network?
Most organizations feel they are in control – until they no longer are. Until production slows. Until a line stops. Until a supplier connection turns out to be a hidden vulnerability. Until a small, unnoticed change has very visible consequences.
By then, the question is not really whether insight matters. It is why it was missing in the first place.
See more, fear Less. Explore
OT cybersecurity insights.
Insights from Norway’s cybersecurity experts
My first Attack conference: Golf, good conversations and a more serious backdrop
How do you present a cybersecurity company to potential customers while you are still learning about it yourself? I got to practise that when I attended my very first conference, the Attack conference, with SecureNOK on 13 October.
SNOK Health Check picks up speed – we are delivering OT overview after OT overview
What equipment is connected to the OT network, and who is communicating with whom? After several projects with the SNOK Health Check, I see how useful it is to get answers to these questions before deciding on the next security measure.
Water supply and critical infrastructure in focus at the Homeland Security Conference in Denmark
What does it take to keep society running when critical infrastructure is exposed to attacks and disruptions? This question was central when I attended the Homeland Security Conference in Copenhagen on 7 October with the Norwegian Cybersecurity Cluster.
Halfway through the OT Roadshow – time for the conversations that often have to wait
Trondheim, Bergen and Stavanger are done, and we are halfway through the OT Roadshow. For me, this is a valuable opportunity to look up from technology development and discuss security with those who know the everyday reality of industry.
Full house as IVAR IKS shared its experiences with OT security
Interest in the webinar with IVAR IKS was greater than we had dared to hope. Through our October campaign on health checks for water and wastewater facilities, we are now making it easier for more organizations to take the same first step towards better overview and control of their OT environments.
ON 104 has been updated: New requirements for safer and more robust operations on the Norwegian continental shelf
From 1 June 2026, the updated version of Offshore Norge Guideline 104 (ON 104 Rev. 7) applies – one of the most important frameworks for cybersecurity in operational technology (OT) in the petroleum industry.
The Norwegian Food Safety Authority's new guide makes one thing clear: Waterworks must now take OT security seriously
The Norwegian Food Safety Authority (Mattilsynet) has now published the first official guide to the Digital Security Regulations for drinking water. It is an important milestone for Norwegian water supply – and a clear signal that the authorities are now stepping up work on digital security in the sector.
OT Konferansen shows the Nordics taking a leading role in OT security
Today, many industrial environments consist of industrial networks, virtual environments, Windows and Linux systems, remote access, patching and backup solutions, security tools, cloud services and integrations with IT.
OT security in the food industry starts with insight
As a project manager on OT security projects, I often encounter the same starting point at industrial companies: They know a great deal about production, processes and equipment – but far less about what the digital infrastructure actually looks like in practice.
Norwegian-developed OT security technology for industry and critical infrastructure
Norwegian industry is becoming increasingly digitalized. Production lines, process plants, energy systems and critical infrastructure are being connected more closely to modern IT systems, external suppliers and digital services. At the same time, there is a growing need for cybersecurity solutions actually developed for industrial environments.
Strong support for OT Konferansen 2026 – bringing together leading experts in Stavanger
OT Konferansen 2026 takes place on 29 April in Stavanger, and this year's edition already stands out with a programme that brings together some of the most central players in OT security and industrial digitalization.
Growing need for control in complex automation environments in oil and gas
In recent years, the digitalization of the oil and gas industry has brought significant gains in efficiency, better data and greater flexibility. At the same time, this development has led to a significant increase in complexity – and therefore also in risk.
How to gain control of the OT environment in practice – experiences from IVAR
For IVAR IKS, stable operations are not just a goal – they are a prerequisite for society to function. As a provider of water and wastewater services to around 360,000 residents in Nord-Jæren, the organization manages critical infrastructure where the consequences of failure are immediate and extensive.
The Preparedness Year 2026: Are water and wastewater in Norwegian municipalities secure enough?
Municipal water supply is among the societal functions covered by the Digital Security Act. The Act entered into force on 1 October 2025 and sets basic requirements for digital security in organizations of particular importance to society. The regulations also place responsibility for digital security clearly with the organization's top management.
Stricter Security Requirements for Critical Services from 1 October 2025 under theDigital Security Act
O nFriday, 20 June, the Norwegian government decided in a Council of State meeting that the Digital Security Act will enter into force on 1 October 2025. At the same time, the Digital Security Regulation was adopted, entering into force concurrently with the Act.
Bremanger Breach: Lessons from a Norwegian Dam Hack
Earlier this year, unidentified hackers breached the control system of a Norwegian dam at Risevatnet, in Bremanger. The hackers discovered that the dam had a Human Machine Interface (HMI) exposed on the Internet and was able to gain access by exploiting a weak password.p
Digitalization: Opportunities and New Risks
Digitalization offers enormous opportunities for efficiency, but it also introduces new risks. When OT systems (Operational Technology) are connected to the internet, vulnerability to attacks increases—attacks that threaten not only data, but also lives, health, and critical societal functions.