Updated after the Gulating Court of Appeal ruling of 30 June 2026. The body below reflects the final outcome.
A Norwegian court delivered a €5.5 million lesson that every manufacturing executive needs to understand.
The case
Btec, an industrial machining company, lost everything in a ransomware attack and sued their IT provider Nordlo for about €5.5 million. The court of appeal found the provider in breach, because the backup server sat on the same network as production, and awarded three months of subscription fees, about €760. The security failings were open to criticism but short of gross negligence, so the standard liability cap stood and indirect loss was excluded. Btec carries about €210,000 of the other side’s legal costs. The contract, not the security posture, decided what the breach was worth. Subscription services are priced on standardisation, and a provider cannot carry tens of millions in exposure on a low-cost contract. The price stated the liability limit years before the attack.
The court of appeal put considerable weight on the fact that caps like the one in Btec’s contract are widespread in the IT industry. The ruling points to the Norwegian state’s standard agreements for IT procurement and to the standard terms of Atea, Braathe Gruppen, Waveit and Procano, which typically cap liability at three, six or twelve months of fees and normally exclude production stoppage and lost profit.
The reality check
Btec paid €254 per month for IT services while running operations worth millions. When disaster struck, they discovered they’d bought basic IT support, not business continuity.
This was a cybersecurity failure on the provider’s side, and on Btec’s side most likely a business continuity planning failure, one that a contract priced for standard IT support was never going to cover.
The critical gap
The backups were running, but the court of appeal found that a backup server holding AutoCalc data sat on the same network as production, a setup that never accounted for ransomware, so the attack took it along with the originals. Btec lost all its files and documents. The two companies never signed a separate written agreement, so Btec was bound by Nordlo’s standard contract, and it is likely that nobody had defined what recovery actually meant for the business, and that nothing in that contract required the provider to ask.
Given the incident, the outcome and what is typical in the industry, the most likely reading is that business continuity was not in place.
Lessons for manufacturing
1. Price reflects the provider’s risk, not yours
Your €254/month IT contract doesn’t cover your €5.5 million business risk. Standard IT support agreements are about keeping systems running, not ensuring business operations survive disasters.
2. Standard agreements aren’t business plans
IT service contracts define technical obligations: uptime targets, response times, backup schedules. They don’t define your business recovery requirements, production dependencies, or operational continuity needs.
3. Accountability can’t be outsourced
You can outsource technical execution. You can’t outsource responsibility for understanding what your business needs to survive. That accountability stays with business leadership.
4. Recovery requires business context
Technical teams can restore systems. Only business leaders can define:
- Which manufacturing processes are critical
- What production data is irreplaceable
- How operations restart after recovery
- What ‘acceptable’ downtime actually means
The questions you need to answer
Before the next incident, manufacturing executives must document:
- How long can production actually stop, and what’s the financial impact per hour?
- Which systems and data keep production running, and where are the single points of failure?
- Who owns the decision to declare a disaster, and who executes recovery beyond just technical restoration?
- How do you restart production processes and validate recovered data?
- What’s the cascade effect when one system fails, and which suppliers are critical to operations?
- Who accepts residual risk during recovery?
The accountability trap
The breach was the provider’s. The exposure was Btec’s. The typical pattern, and probably the one here, is that the customer assumes the provider understands its business continuity needs, the provider assumes the customer has communicated them, and neither assumption gets tested until disaster strikes.
The gap between technical capability and business requirement is where companies fail.
What this means for you
If you’re relying on standard IT support contracts to protect your manufacturing operations:
- Document your actual recovery requirements based on business impact, not technical capabilities.
- Validate your provider understands manufacturing-specific continuity needs.
- Test recovery procedures that include business process restart, not just system restoration.
- Define accountability clearly for business continuity decisions and execution.
Have you validated that your IT service agreements actually cover your business continuity requirements? The time to discover gaps in your recovery planning is before the incident, not in court afterward. For a deeper look at why recovery plans break down in practice, see Your recovery targets are probably right. Your ability to meet them probably isn’t.
Originally published: LinkedIn
Case Reference: Btec AS v. Nordlo Norge AS, Norwegian court ruling, 2025 Source: Norwegian court ruling coverage
Appeal: Btec AS v. Nordlo Norge AS, Gulating lagmannsrett, 30 June 2026 Currency: Kroner figures converted at 10.87 NOK to the euro, the Norges Bank rate on 21 August 2026. Appeal coverage: Metal Supply on the ruling • Metal Supply on the contract reasoning
A renewal decided on the same ground, the policy terms rather than the posture, is on record in A cyber insurance renewal that bought a policy that responds, not only a cheaper premium, with the alternatives set aside and their cost.
I advise industry and energy companies on security governance and risk management. More about my work.