Norway stabilises digital services after major DDoS attack

Norway's government digital services have largely returned to normal following a prolonged distributed denial-of-service (DDoS) attack that began on Monday, August 24, and concluded on Wednesday evening, August 26. The Digitalisation Agency (Digdir) reported that the attack stopped around 7:30 PM on Wednesday. By Thursday morning, most systems were operating normally, although some external traffic experienced continued disruption as defensive measures remained in place.

The attack targeted shared infrastructure operated with Digdir's technology partner Vivicta, affecting several public-sector services including ID-porten, MinID, Altinn, eInnsyn, and others. Users encountered slow responses, failed connections, and login problems during the attack. Despite this, ID-porten and other shared solutions remained available for most of the assault, aside from brief interruptions.

Digdir director Frode Danielsen emphasized the severity of the incident, stating that Digdir's common digital systems are utilized across Norway's public sector. He clarified that the purpose of a DDoS attack is typically to disrupt availability rather than to infiltrate systems, and there was no indication that attackers gained access to Digdir's systems or compromised personal information.

Both the Norwegian Data Protection Authority and the National Security Authority were notified in accordance with established procedures.

This incident marked the third DDoS attack on Digdir's shared systems during the summer, with the latest being significantly larger than previous incidents in late June and early August. A pro-Russian hacking group called Server Killers claimed responsibility, alleging the attack was retaliation for Norway's support of Ukraine. While authorities have not verified this claim, no official technical attribution has been announced.

The attack pattern varied, with traffic arriving in waves, complicating mitigation efforts and resulting in partial service recoveries. Users reported difficulties accessing services connected with tax administration, welfare, and health systems. Digdir warned that limitations on ID-porten, a common gateway allowing users to authenticate for thousands of public services, could impact organizations relying on the login service. During the disruption, restrictions were imposed to manage the malicious traffic.