Norway restores shared public digital services after DDoS attack

The situation

Norway’s Digitalisation Directorate reported at 14:50 CEST on 27 August that the public-sector services affected by a distributed denial-of-service attack were functioning normally. The attack began at 03:38 CEST on 24 August and stopped at about 19:30 CEST on 26 August after intermittent activity and renewed disruption.

The incident affected shared infrastructure including ID-porten, Altinn, MinID, Maskinporten, eSignering, Digital Postkasse, eFormidling and eInnsyn. Access restrictions on ID-porten disrupted some authentication-dependent services, including electronic signing. Digdir said the attack was intended to impair availability, found no indication of a security breach or personal-data exposure, and has not publicly attributed it to any actor, group or country.

Why it matters

The restoration limits the immediate continuity risk to digital services used across Norway’s public sector, particularly authentication, signing, data exchange and administrative workflows. Remaining remediation for some foreign-origin traffic indicates that service delivery has stabilised but that protective measures and post-incident monitoring remain operationally relevant.

The episode highlights the resilience exposure created by reliance on common digital platforms: disruption to a central authentication service can propagate into multiple government-facing functions even without a confirmed intrusion or data compromise.

What changed

Digdir moved from mitigation and access restrictions to reporting normal operation across the affected services on 27 August.

Impacts

Political Stability

Restoration of shared authentication and administrative services reduces the immediate risk of disruption to public-sector digital access and workflows.

Military & Security

The attack demonstrated a cyber resilience vulnerability in nationally shared digital infrastructure, but there is no public attribution, evidence of intrusion or indication of compromised personal data.

Economic Pressure

Normal operation reduces the risk that disrupted authentication and electronic-signing functions delay transactions and administrative processes reliant on public digital services.

What to watch

• Does Digdir remove the remaining remediation measures for traffic from abroad while sustaining normal access across the affected services?
• Does a subsequent technical or investigative update identify an attacker, a source of the traffic, or evidence that changes the assessment of data-security risk?

Evidence and uncertainty

Low confidence. Low confidence. 2 retained references from 1 reporting origins (Digitalisation Directorate of Norway). Claim-level independent corroboration has not been established. Confidence concerns the evidence for the reported development, not the probability of an outlook.

Useful context

Digdir

The Norwegian Digitalisation Directorate, which operates and coordinates shared digital services for the public sector.

It reported the incident status, mitigation measures and restoration of the affected services.

DDoS

A distributed denial-of-service attack, in which traffic from multiple sources is used to overwhelm a service and impair availability.

Digdir identified this as the method used to disrupt the shared services.

ID-porten

Norway’s shared public digital authentication service.

Access restrictions to the service disrupted authentication-dependent functions during the incident.

Geographic context

Sources

1. Publisher homepage · not a direct report linkDigitaliseringsdirektoratet Status: shared-service disruption incident
   Digitalisation Directorate of Norway homepageDigitalisation Directorate of Norway · 27 August 2026
2. Norwegian shared digital services stabilised after DDoS attack; attack activity appears to have endedDigitalisation Directorate of Norway · 27 August 2026