PARIS -- Renault said 90 percent of its factories were running normally on Monday morning after the automaker had earlier halted production at sites in France and Romania to prevent the spread of ransomware.
Renault stopped production at several sites on Saturday to prevent the spread of a global cyberattack that hit its computer systems the previous day.
The UK plant of alliance partner Nissan in Sunderland, northeast England, was also affected.
The attack affected computer operations worldwide, including at the Russian Interior Ministry, the National Health Service in Britain and FedEx in the United States.
Representatives at Renault's Sandouville plant, in northern France, told French media on Saturday that production had been halted there. The Renault Trafic van and variants for other automakers are produced at the factory. The Sandouville representatives said that disruption would be minimal, as no full production was planned for the weekend.
A work stoppage was also reported at Renault’s facility in Novo Mesto, Slovenia, which produces the Renault Twingo and Clio small cars.
Renault-owned Dacia said on Saturday some of its production in Romania had been hit.
The Paris prosecutor has opened an investigation following the cyberattack, a judicial source told Reuters on Saturday. The probe covers "Renault and other possible victims," the source said.
PSA Group, Renault's French rival, was not affected, a PSA spokesman said.
Nissan said its UK plant was subject to a ransomware attack affecting some systems on Friday evening. A spokesman declined to confirm media reports that production at the plant, which employs 7,000, had been halted.
The plant builds the Nissan Leaf, Qashqai, Note and Juke along with the Infiniti Q30 and QX30.
On Friday, cyber extortionists tricked victims into opening malicious malware attachments to spam emails that appeared to contain invoices, job offers, security warnings and other legitimate files.
Staff reporter Peter Sigal and Reuters contributed to this report