Norway stabilises digital services after major DDoS attack

Norway’s government digital services have largely returned to normal after a sustained distributed denial-of-service attack against infrastructure supporting the Norwegian Digitalisation Agency ended on Wednesday evening, following more than two days of disruption.

Digitaliseringsdirektoratet, known as Digdir, said the attack stopped at about 7.30pm on Wednesday, August 26, after beginning at 3.38am on Monday. By Thursday morning, most systems were operating normally, although some traffic from outside Norway was still experiencing disruption as defensive measures remained in place.

The attack targeted infrastructure operated with Digdir’s technology partner Vivicta and affected shared public-sector services used for identity verification, secure communication and access to government systems. ID-porten, MinID, Altinn, eInnsyn and other services were among those affected, with users at times facing slow responses, failed connections and login problems.

Digdir said ID-porten and its other shared solutions remained available for most of the attack, apart from short periods of interruption. The agency continued operating protective measures after the hostile traffic subsided and said it expected a gradual return to standard operating conditions.

Frode Danielsen, director of Digdir, said the episode was serious because the agency’s common digital systems are used throughout Norway’s public sector. He said the purpose of a DDoS attack is to undermine availability rather than to break into systems, and Digdir found no indication that attackers had gained access to its systems or compromised personal information.

The Norwegian Data Protection Authority and the National Security Authority were notified under established procedures. Digdir has said service disruptions involving systems that process personal information trigger routine notifications even when there is no evidence that data has been exposed.

The incident was the third DDoS attack to affect Digdir’s shared systems this summer. Similar attacks caused outages in late June and early August, but Digdir described this week’s assault as substantially larger. Press officer Are Kvistad said while the attack was under way that it was two to three times larger than the previous incident and the biggest the agency had experienced against its shared solutions.

A pro-Russian hacking group calling itself Server Killers claimed responsibility on Wednesday and said the attack was linked to Norway’s support for Ukraine. Norwegian authorities have not publicly verified that claim, and no official technical attribution has been announced.

The group referred to expanded security cooperation between Norway and Ukraine, including commitments involving drone technology and the Nansen support programme. Prime Minister Jonas Gahr Støre visited Kyiv on August 23 and announced that the government would propose 85 billion Norwegian kroner in support for Ukraine in next year’s state budget. The allocation remains subject to the budget process.

Officials said the pattern of disruption varied as traffic arrived in waves, complicating mitigation efforts and producing availability problems rather than a continuous outage. Some functions recovered while others remained constrained, requiring users to retry transactions or wait before reconnecting.

The outage demonstrated the reach of Digdir’s infrastructure because several public services depend on its authentication and data-exchange systems even when they are not themselves directly targeted. ID-porten serves as a common gateway allowing users to authenticate for thousands of public services, while Altinn provides digital communication and administrative services for individuals and businesses.

During the disruption, users reported difficulty reaching services connected with tax administration, welfare and health systems. Digdir warned that limitations on ID-porten could affect organisations relying on the login service and imposed restrictions while technicians and suppliers worked to absorb the malicious traffic.

DDoS attacks seek to overwhelm servers or network infrastructure by directing large volumes of artificial traffic at them, preventing legitimate users from obtaining normal access. Unlike intrusions designed to steal information, such attacks primarily target service availability, although prolonged outages can disrupt administrative and commercial activity.