Renault Looks to Resume Production at Some Plants

French auto maker Renault SA was scrambling Sunday to resume operations at plants across Europe after its computer systems were hit by a virus that swept the globe.

A Renault spokesman said the manufacturer was forced to halt production at plants in France, Romania and Slovenia after the firm's IT security team spotted the so-called "ransomware" worm in its systems around midnight on Friday.

The virus takes advantage of security vulnerabilities in Microsoft Corp. software that was either too old to be supported by security patches, or hadn't been patched by users. The malware scrambled files of infected computers, then promised to restore the files after ransom payments by bitcoin of as little as $300 each. Security experts have been able to track a small amount of bitcoin transaction they say is linked to the attack and is likely ransom. But it was impossible to say how many companies were paying.

Renault didn't pay a ransom, the spokesman said. Instead the company moved to quarantine the virus by halting plants that use Windows software or any other networks vulnerable to the malware. Meanwhile, its cybersecurity team pored over company computer systems, looking for where the virus penetrated its network.

"We don't know if the problem started in France or if it came through Romania or Slovenia or somewhere else," the spokesman said.

On Saturday night, the company began restoring operations at some of the halted plants with the goal of getting nearly all of the affected production back online by Monday morning.