It said it had isolated all plants and operations and was switching to manual operations and procedures where possible.
"Hydro is working to contain and neutralise the attack but does not yet know the full extent of the situation," the company said.
"It is too early to indicate the operational and financial impact, as well as timing to resolve the situation."
It said it would use Facebook as its main external communication channel.
In a webcast, CFO Eivind Kallevik described it as ransom attack. He said it was important to note there were no safety-related incidents.
"Let me be clear," he said.
"The situation for Hydro through this is quite severe.
"The entire worldwide network is down affecting our production as well as our office operations."
It is the latest setback for the company, which is yet to resume full operations at its Alunorte refinery in Brazil, where it was ordered to halve production last year over water contamination concerns.
Bloomberg reported it was the latest cyberattack to hit the commodities sector, referring to a recent attack on zinc smelter Nyrstar and on Saudi and Russian oil giants Aramco and Rosneft PJSC.
