Since Monday at 3:38am, a large-scale DDoS attack has been disrupting Norway's shared government digital infrastructure — and this is already the third such attack on the country's Digitalisation Agency (Digdir) since June, with this one reportedly 2-3 times larger than the previous ones.
Affected services read like critical national infrastructure: ID-porten (the digital identity gateway used by over 4.5 million people), Altinn, MinID, and several inter-agency data exchange systems — disrupting everything from tax filing to electronic prescriptions.
One piece of good news: Norwegian authorities confirm no evidence of a data breach or security compromise. This is a pure availability attack — flooding, not infiltrating.
No official attribution yet; Norwegian media have speculated about Russian involvement, but that remains unconfirmed.
What's worth noting regardless of attribution: DDoS is one of the least sophisticated attack methods available — no exploit, no stolen credentials. It simply floods a system until it can't respond. And it's still effective enough to disrupt a national government's digital services three times in three months.
This joins a pattern across Europe in just the past few weeks: a UK power plant cyberattack, Berlin's state administration knocked offline, and now Norway's government services repeatedly. Different countries, different attackers, same lesson: public-sector digital infrastructure keeps proving to be a soft, repeatable target.
Does your organisation know how it would hold up under a sustained DDoS attempt — and would it survive a second one shortly after the first?
Research as of: August 27, 2026 — Regulation evolves quickly; this post does not replace individual legal or professional advice.
