Attacks in Norway

NRK found sick pay details, account numbers and children's ID numbers in Nav's public code on GitHub. Nav says 26 people are directly affected and has removed the data. Not an outside attack.

An actor had access to Amadeus' booking system from August 2023. NSM says names, routes and some passport numbers leaked. Nearly 300 bookings from 75 Norwegian organisations were viewed.

Intruders accessed personal data on several thousand Strawberry customers at gift card provider Gift Up. Payment data is not affected. Strawberry is replacing the codes on all active gift cards.

VISIT, which supplies booking software to hotels and tour operators, was breached in late October. Part of the customer data of Brim Explorer and Fjellheisen in Tromsø was taken.

Intruders spent four hours inside Front Systems' point-of-sale platform on 5 November. Gift card data and staff logins were taken, likely customer names and emails too. Card data was not hit.

Overnight on 3 November Havaristen's freezer room was heated via an unsecured 4G link. Plastic melted and sprinklers went off. The manager confirms a hack. Noname057(16) and Z-Pentest claim the wave.

On 3 November the cold rooms at Ullensvang Fruktlager were set to 50°C. The system was exposed to the internet. Only one room was in use. The actor is unknown.

Attackers used 27 accounts in Norad's grant portal. Names and emails of up to 20,614 users may be taken, plus applications from at least three organisations. NSM sees links to other attacks.

UiT found a targeted attack by a well-resourced actor on 29 October. By 3 November the situation was stable, but some library and language services were still down. The actor is unknown.

On 26 October Gripr found its database had been copied via an unpatched flaw, exploited since 7 October. Up to 85,000 contacts and 45,500 private individuals affected, some with ID numbers.

Intruders downloaded Cheap Energy customer data through a flaw at a system supplier, found on 5 October. National ID and account numbers are affected. Customers were told over two weeks later.

Adresseavisen reported on 20 October that Trondheim restaurant Bula Neobistro was hit by an attack that flooded it with fake table bookings. The restaurant calls it a targeted attack.

Citizen Lab said on 15 October that ads from Israel's Discover-Tech, a channel for Candiru spyware, reached the networks of Stortinget, Kripos, Nkom and Digdir. No infection confirmed in Norway.

Everest listed Laerdal Medical on its leak site on 13 October. On 16 October Laerdal said a third-party software provider was hit, exposing staff data. It sees no sign customer data was affected.

Nordland county closed its eInnsyn public records log after names in child welfare, PPT and dental cases were exposed. 15 people in 30 cases found so far. The data protection authority was notified.

Oslo printer Konsis confirms on its website that it was hit by ransomware. Settra listed the company on its leak site in October, gave 29 September as the attack date and claims 95 GB of data.

DN's "Dubai-pengene" story was stolen and posted online on 25 September. A businessman is charged with computer intrusion. He says a friend found it with AI; DN says its logs show a targeted attack.

The Norwegian Intelligence Service said a state actor had full access to the admin systems of a Norwegian critical-infrastructure company for a long period. The company never noticed.

The Norwegian Intelligence Service said state actors have run cyber operations against Ukrainian targets through Norwegian digital infrastructure to hide where the attacks came from.

Akira listed Oslo dealer Lazy Boyz (Harley-Davidson, Royal Enfield) on its leak site on 15 September, threatening to publish staff data, financials and contracts. The company confirmed the attack.

Stortinget.no became unstable around 15:00 on Monday 14 September and was back to normal by 16:23. Server Killers announced the attack on Telegram. Feide was hit the same day.

An attacker had access to Easee's CFO mailbox from 7 May to 11 June. Staff ID numbers, salary, bank and health data plus the shareholder register may have been read. Found via invoice fraud.

Norsk Tipping hit by a DDoS attack at 19:00 on Wednesday 9 September, causing login problems. A second traffic surge came Thursday morning; systems were back up Thursday afternoon. Actor unknown.

FpU's website was hacked on Monday 7 September and its content altered. Traffic was temporarily redirected to frp.no while the incident was investigated. No actor identified.

UDI websites went down on Friday 4 September. Server Killers claimed responsibility; UDI says internal systems were unaffected. Part of a wave against Norwegian public services.

Dustin shut its web shops in six countries on 3 September. FulcrumSec published 6.2 TB of source code and a register of 1M+ accounts on 14 September, naming Nav and Statnett among the customers.

Intruders gained admin rights in Ahus' Kompetansebroen portal. Data on some 100,000 users may be exposed, and about 50 patient-submitted messages were found in the system. Datatilsynet notified.

DDoS on the higher-education sector on 2 and 4 September took down Feide and sites at UiO, NTNU, OsloMet and others. Feide was hit again on 14 September. Server Killers claimed it.

DDoS against Sikt on Saturday 29 August left Feide, Educloud, Samordna opptak, fsweb and UiO intermittently unavailable. Server Killers claimed it; no sign of research data exposure.

DDoS on hosting partner Vivicta from 03:38 on 24 August to 26 August hit ID-porten, MinID, Altinn and Maskinporten. Digdir says it was the third in nine weeks. Kripos is investigating.

A Russian hacker group claims names and phone numbers of 160,000+ Cars Software customers were taken, allegedly from a 10-year-old backup. Police, Datatilsynet and Telenor Cyberdefence involved.

Intruders accessed customer data in Kristiansand Feriesenter's booking system. Names, emails and phone numbers are affected. The case has been reported to the Data Protection Authority.

System provider notified Sit on 14 August that outsiders may have accessed its customer database. Up to 780 students affected; names, emails, national ID numbers, addresses. Likely SMS pumping.

Intrusion into the publishing system overnight into 7 August. Attackers claimed subscriber logs and plaintext passwords and said they were Anonymous. Document doubts that claim.

DDoS on hosting partner Vivicta the night of 3 August took down ID-porten, MinID, Altinn and several health services. Normal operations restored 4 August. No indication of a data breach.

Three DDoS attacks in one week (2, 4 and 7 August) took Oddsen and the websites down for periods. Telenor filtered the traffic and all incidents were reported to police. No data theft.

Unauthorized access the night of 2 August exposed 4.5 million accounts, 1.6 million in Norway. On 18 August the data was offered for sale on a criminal forum. Datatilsynet notified.

Maps of the water and sewage network, risk assessments and contingency plans covering 180,000 residents leaked after the Lørenskog attack. Operations and water quality unaffected.

Data from Trondheim IT provider Alpha IT was published on the dark web, with real-estate firm Ragde Eiendom among named customers. Up to 15 companies affected. PST passed the case to Kripos.

DDoS on hosting partner Vivicta from Saturday 20 June until Sunday morning made several of Digdir's shared services unavailable. The same partner was hit again on 3 August.

Norwegian union NTL (LO, 59,000+ members) hit by ransomware on 16 June; central IT systems taken offline. Sensitive personal data may be compromised. Datatilsynet and NSM notified.

Norsk Tipping hit by DDoS three times in one week (2, 3 and 5 June). Games and websites slowed/unavailable; Telenor filtered the traffic each time. No data theft indicated; perpetrator unknown.

Gran municipality leaked personal data on 27 residents, mainly national ID numbers, due to flawed manual FOIA handling. 18 cases affected. Discovered when a new scanning tool was deployed.

Ransomware found 9 May; the attacker got in 7 April via an infected download. 1.8 TB was published in July. Deloitte found a 26-day response gap. The 2027 budget sets aside NOK 34.5m for the fallout.

Fredrikstad and Hvaler municipalities had directory data on ~7,000 employees posted on a criminal forum 2 May. Employee search function abused to expose names, emails, phone numbers.

Canvas vendor Instructure leaked 3.65 TB; 37 Norwegian institutions affected. ShinyHunters behind it; ransom paid 11 May. A suspected ShinyHunters member was detained in Jordan on 29 September.

On 19 March attackers exploited a third-party software flaw at Ikea IT AB and downloaded data on up to 3,261 employees and 42,370 customers in Norway. Attacker unknown.

Sats Norway hit by data breach 14 March. 3,750 current and former employees affected via file server with HR and accounting data. Membership system not affected. Criminal group threatened to leak.

DKS portal data leak via vendor Netpower. Anonymous actor claims 1.39M rows stolen with names, addresses, emails and messages on performers, planners and school staff. No pupil data.

Crypto virus on selected onboard PCs of a vessel operated by Wilhelmsen Ship Management on 18 February. No land based systems affected. Lockbit 5.0 claimed responsibility via leak site.

In its 2026 national threat assessment, PST disclosed that Chinese actor Salt Typhoon compromised vulnerable network devices at Norwegian organisations. Victims were not named.

Breach found November 2025; Payoutsking published 2.5 TB in February. Around 500,000 private customers, 3,000 business customers and staff in 17 municipalities hit. Kripos is investigating.

AdvokatWatch reported that 31 Norwegian law firms were affected by digital security breaches in 2025, tied to NSR warnings about Microsoft 365 account compromises.

Lyd & Bilde's websites compromised with a fake reCAPTCHA/ClickFix popup trying to trick visitors into running malicious PowerShell scripts. Both Norwegian and Swedish editions hit.

Criminals threatened to leak 79 GB from Swedish supplier Enea, which sells software to mobile operators worldwide. Ice confirmed it was affected and Telia was assessing the consequences.

Six county governor offices issued FOIA PDFs with unredacted national ID numbers and names in metadata. At least 150 people affected in Innlandet. Datatilsynet notified.

Kripos warned in Jan 2026 that several Norwegian SMBs were hit by ransomware via old SonicOS SSL VPN bug. First known incident in Nov 2025. Akira suspected. Victims unnamed.

Unknown intruders accessed the Norwegian Veterinary Institute's computer systems. The case was reported to police. Security chief could not determine the cause.

Technical fault on Helsenorge briefly exposed other patients' national ID numbers and names for about 50 minutes. Not external hacking. Norsk helsenett notified Datatilsynet.

Dynamic Precision in Kjeller, a Norwegian PCB manufacturer supplying defense and aerospace, hit by a data breach involving server encryption (ransomware).

Lovdata's websites suffered DDoS over several days in September. Attackers attempted to overload the systems to make the site unavailable. User data not targeted.

The Conservative Party's websites hit by DDoS in final week of the parliamentary election campaign. NSM and the party attributed it to pro-Russian NoName057(16).

Ringerike and several Norwegian municipalities plus Østfold county council had websites hit by DDoS. Pro-Russian NoName057(16) claimed responsibility, motivated by the election.

PST confirmed a new data breach in Eastern Norway by the same pro-Russian group as the Bremanger dam. Physical processes affected without danger. Victim not publicly named.

Trondheim software vendor Extend AS hit by ransomware. Four municipalities (Bergen, Drammen, Kristiansand, Ringsaker) and NTNU (~77,500 emails in test env) had data compromised via EQS.

Hackers encrypted two servers and exfiltrated ~10 GB from Narvik port, a NATO-strategic logistics hub. A previously unknown group published the data. Kripos and NSM notified.

Pro-Russian hackers opened a valve at the Risevatnet dam in Bremanger, releasing 500 L/s for nearly 4 hours. PST attributed in August to a pro-Russian group via weak password.

Freight and logistics firm in Skjetten near Lillestrøm hit by ransomware. Company (~30 employees, ~NOK 100M revenue) had to wipe its own servers to recover. Identity withheld.

Genus, no-code platform vendor to the Norwegian police, hit by ransomware in January. Several GB of sensitive data incl. customer contracts with national ID numbers leaked on the dark web.

Location data broker Unacast/Gravy Analytics hacked. About 146,000 Norwegian mobile devices likely affected; movement data leaked on a Russian hacker forum. Datatilsynet notified.

Gran municipality detected an intrusion on 17 December. Attackers had a foothold on an unpatched server and installed VNC, stopped before ransomware deployment. No known exfiltration.

Personal data on Tensio employees (incl. national ID numbers and salaries) was inadvertently made public on an external site by a partner during a pension tender. Datatilsynet notified.

Attackers took over the CEO's email at Hå Rugeri and sent a fake invoice to a supplier who paid EUR 73,686 (~NOK 868,000) to the wrong account. Reported to Datatilsynet and police.

Nordea was hit by a wave of denial-of-service attacks from mid-September 2024. One ran for about 25 days and gave Norwegian customers trouble with online and mobile banking. No data taken.

Norwegian police investigated a suspected data breach at ISAR Aerospace Norge on Andøya. A Hungarian former employee was arrested for downloading company data to an external drive.

Logistics firm Skanlog hit by LockBit 3.0 ransomware on 21 April. Deliveries to Vinmonopolet halted. Skanlog represented ~20% of Vinmonopolet's volume.

Avarn Security AS confirmed it was hit by ransomware on 22 February 2024. IT teams worked to contain damage and restore operations; customers were notified.

PST, FBI and partners disrupted a Russian APT28 router botnet using vulnerable TP-Link devices as relays. About ten compromised routers in Norway were identified and patched.

Police notified Sør-Varanger that login credentials had been resold on the dark web for $10. The attack was stopped in early reconnaissance with help from Atea.

NBBL trade body and subsidiaries (incl. insurance arms) hit by ransomware. NBBL refused to pay ransom. Reported to Datatilsynet and police.

Akira ransomware hit a Tietoevry data center in Sweden on the night of 20 January. Norwegian customers including Moelven Industrier were indirectly impacted via shared services.