Attacks in Norway

The Norwegian Intelligence Service said a state actor had full access to the admin systems of a Norwegian critical-infrastructure company for a long period. The company never noticed.

The Norwegian Intelligence Service said state actors have run cyber operations against Ukrainian targets through Norwegian digital infrastructure to hide where the attacks came from.

Akira listed Oslo dealer Lazy Boyz (Harley-Davidson, Royal Enfield) on its leak site on 15 September, threatening to publish staff data, financials and contracts. The company confirmed the attack.

Stortinget.no became unstable around 15:00 on Monday 14 September and was back to normal by 16:23. Server Killers announced the attack on Telegram. Feide was hit the same day.

An attacker had access to Easee's CFO mailbox from 7 May to 11 June. Staff ID numbers, salary, bank and health data plus the shareholder register may have been read. Found via invoice fraud.

Norsk Tipping hit by a DDoS attack at 19:00 on Wednesday 9 September, causing login problems. A second traffic surge came Thursday morning; systems were back up Thursday afternoon. Actor unknown.

FpU's website was hacked on Monday 7 September and its content altered. Traffic was temporarily redirected to frp.no while the incident was investigated. No actor identified.

UDI websites went down on Friday 4 September. Server Killers claimed responsibility; UDI says internal systems were unaffected. Part of a wave against Norwegian public services.

Dustin shut its web shops in six countries on 3 September. FulcrumSec published 6.2 TB of source code and a register of 1M+ accounts on 14 September, naming Nav and Statnett among the customers.

Intruders gained admin rights in Ahus' Kompetansebroen portal. Data on some 100,000 users may be exposed, and about 50 patient-submitted messages were found in the system. Datatilsynet notified.

DDoS on the higher-education sector on 2 and 4 September took down Feide and sites at UiO, NTNU, OsloMet and others. Feide was hit again on 14 September. Server Killers claimed it.

DDoS against Sikt on Saturday 29 August left Feide, Educloud, Samordna opptak, fsweb and UiO intermittently unavailable. Server Killers claimed it; no sign of research data exposure.

DDoS on hosting partner Vivicta from 03:38 on 24 August took down ID-porten, MinID, Altinn and Maskinporten. It ran for over three days; Digdir declared services healthy on 27 August.

A Russian hacker group claims names and phone numbers of 160,000+ Cars Software customers were taken, allegedly from a 10-year-old backup. Police, Datatilsynet and Telenor Cyberdefence involved.

System provider notified Sit on 14 August that outsiders may have accessed its customer database. Up to 780 students affected; names, emails, national ID numbers, addresses. Likely SMS pumping.

Intrusion into the publishing system overnight into 7 August. Attackers claimed subscriber logs and plaintext passwords and said they were Anonymous. Document doubts that claim.

DDoS on hosting partner Vivicta the night of 3 August took down ID-porten, MinID, Altinn and several health services. Normal operations restored 4 August. No indication of a data breach.

Three DDoS attacks in one week (2, 4 and 7 August) took Oddsen and the websites down for periods. Telenor filtered the traffic and all incidents were reported to police. No data theft.

Unauthorized access the night of 2 August exposed 4.5 million accounts, 1.6 million in Norway. On 18 August the data was offered for sale on a criminal forum. Datatilsynet notified.

Maps of the water and sewage network, risk assessments and contingency plans covering 180,000 residents leaked after the Lørenskog attack. Operations and water quality unaffected.

Data from Trondheim IT provider Alpha IT was published on the dark web, with real-estate firm Ragde Eiendom among named customers. Up to 15 companies affected. PST passed the case to Kripos.

DDoS on hosting partner Vivicta from Saturday 20 June until Sunday morning made several of Digdir's shared services unavailable. The same partner was hit again on 3 August.

Norwegian union NTL (LO, 59,000+ members) hit by ransomware on 16 June; central IT systems taken offline. Sensitive personal data may be compromised. Datatilsynet and NSM notified.

Norsk Tipping hit by DDoS three times in one week (2, 3 and 5 June). Games and websites slowed/unavailable; Telenor filtered the traffic each time. No data theft indicated; perpetrator unknown.

Gran municipality leaked personal data on 27 residents, mainly national ID numbers, due to flawed manual FOIA handling. 18 cases affected. Discovered when a new scanning tool was deployed.

Ransomware found 9 May; attacker got in 7 April via an infected download. A Deloitte review in September found a 26-day gap between the first alert and action taken. 1.8 TB was published in July.

Fredrikstad and Hvaler municipalities had directory data on ~7,000 employees posted on a criminal forum 2 May. Employee search function abused to expose names, emails, phone numbers.

Canvas vendor Instructure leaked 3.65 TB. 37 Norwegian institutions affected including UiO, NTNU, OsloMet, NMBU, Innlandet, USN. ShinyHunters behind it. Ransom paid 11 May.

Sats Norway hit by data breach 14 March. 3,750 current and former employees affected via file server with HR and accounting data. Membership system not affected. Criminal group threatened to leak.

DKS portal data leak via vendor Netpower. Anonymous actor claims 1.39M rows stolen with names, addresses, emails and messages on performers, planners and school staff. No pupil data.

Crypto virus on selected onboard PCs of a vessel operated by Wilhelmsen Ship Management on 18 February. No land based systems affected. Lockbit 5.0 claimed responsibility via leak site.

In its 2026 national threat assessment, PST disclosed that Chinese actor Salt Typhoon compromised vulnerable network devices at Norwegian organisations. Victims were not named.

Breach found November 2025; Payoutsking published 2.5 TB in February. Around 500,000 private customers, 3,000 business customers and staff in 17 municipalities hit. Kripos is investigating.

AdvokatWatch reported that 31 Norwegian law firms were affected by digital security breaches in 2025, tied to NSR warnings about Microsoft 365 account compromises.

Lyd & Bilde's websites compromised with a fake reCAPTCHA/ClickFix popup trying to trick visitors into running malicious PowerShell scripts. Both Norwegian and Swedish editions hit.

Criminals threatened to leak 79 GB from Swedish supplier Enea, which sells software to mobile operators worldwide. Ice confirmed it was affected and Telia was assessing the consequences.

Six county governor offices issued FOIA PDFs with unredacted national ID numbers and names in metadata. At least 150 people affected in Innlandet. Datatilsynet notified.

Kripos warned in Jan 2026 that several Norwegian SMBs were hit by ransomware via old SonicOS SSL VPN bug. First known incident in Nov 2025. Akira suspected. Victims unnamed.

Unknown intruders accessed the Norwegian Veterinary Institute's computer systems. The case was reported to police. Security chief could not determine the cause.

Technical fault on Helsenorge briefly exposed other patients' national ID numbers and names for about 50 minutes. Not external hacking. Norsk helsenett notified Datatilsynet.

Dynamic Precision in Kjeller, a Norwegian PCB manufacturer supplying defense and aerospace, hit by a data breach involving server encryption (ransomware).

Lovdata's websites suffered DDoS over several days in September. Attackers attempted to overload the systems to make the site unavailable. User data not targeted.

The Conservative Party's websites hit by DDoS in final week of the parliamentary election campaign. NSM and the party attributed it to pro-Russian NoName057(16).

Ringerike and several Norwegian municipalities plus Østfold county council had websites hit by DDoS. Pro-Russian NoName057(16) claimed responsibility, motivated by the election.

PST confirmed a new data breach in Eastern Norway by the same pro-Russian group as the Bremanger dam. Physical processes affected without danger. Victim not publicly named.

Trondheim software vendor Extend AS hit by ransomware. Four municipalities (Bergen, Drammen, Kristiansand, Ringsaker) and NTNU (~77,500 emails in test env) had data compromised via EQS.

Hackers encrypted two servers and exfiltrated ~10 GB from Narvik port, a NATO-strategic logistics hub. A previously unknown group published the data. Kripos and NSM notified.

Pro-Russian hackers opened a valve at the Risevatnet dam in Bremanger, releasing 500 L/s for nearly 4 hours. PST attributed in August to a pro-Russian group via weak password.

Freight and logistics firm in Skjetten near Lillestrøm hit by ransomware. Company (~30 employees, ~NOK 100M revenue) had to wipe its own servers to recover. Identity withheld.

Genus, no-code platform vendor to the Norwegian police, hit by ransomware in January. Several GB of sensitive data incl. customer contracts with national ID numbers leaked on the dark web.

Location data broker Unacast/Gravy Analytics hacked. About 146,000 Norwegian mobile devices likely affected; movement data leaked on a Russian hacker forum. Datatilsynet notified.

Gran municipality detected an intrusion on 17 December. Attackers had a foothold on an unpatched server and installed VNC, stopped before ransomware deployment. No known exfiltration.

Personal data on Tensio employees (incl. national ID numbers and salaries) was inadvertently made public on an external site by a partner during a pension tender. Datatilsynet notified.

Attackers took over the CEO's email at Hå Rugeri and sent a fake invoice to a supplier who paid EUR 73,686 (~NOK 868,000) to the wrong account. Reported to Datatilsynet and police.

Nordea was hit by a wave of denial-of-service attacks from mid-September 2024. One ran for about 25 days and gave Norwegian customers trouble with online and mobile banking. No data taken.

Norwegian police investigated a suspected data breach at ISAR Aerospace Norge on Andøya. A Hungarian former employee was arrested for downloading company data to an external drive.

Logistics firm Skanlog hit by LockBit 3.0 ransomware on 21 April. Deliveries to Vinmonopolet halted. Skanlog represented ~20% of Vinmonopolet's volume.

Avarn Security AS confirmed it was hit by ransomware on 22 February 2024. IT teams worked to contain damage and restore operations; customers were notified.

PST, FBI and partners disrupted a Russian APT28 router botnet using vulnerable TP-Link devices as relays. About ten compromised routers in Norway were identified and patched.

Police notified Sør-Varanger that login credentials had been resold on the dark web for $10. The attack was stopped in early reconnaissance with help from Atea.

NBBL trade body and subsidiaries (incl. insurance arms) hit by ransomware. NBBL refused to pay ransom. Reported to Datatilsynet and police.

Akira ransomware hit a Tietoevry data center in Sweden on the night of 20 January. Norwegian customers including Moelven Industrier were indirectly impacted via shared services.