Norway stabilises shared public digital services after DDoS attack

The situation

Norway’s Digitalisation Agency, Digdir, said on 25 August that its shared digital services had been stabilised following a DDoS attack that began at 03:38 CEST on 24 August. The attack targeted services used across the public sector, including a common-login function, and was intended to impair availability rather than gain access to systems.

Digdir said it largely preserved service availability and had found no indication of a security breach or personal-data exposure, though some services continued to face operational disruption. A group calling itself Server Killers claimed responsibility on 26 August and cited Norway’s Ukraine-related security cooperation, but Norwegian authorities had not publicly verified the claim or attributed the attack to Russia or any state actor.

Why it matters

The incident tested the resilience of shared state digital infrastructure rather than a single public website. Continued mitigation and residual disruption leave public-service continuity exposed if attack traffic resumes or expands, even though the confirmed impact so far is limited to availability.

The unverified political claim gives the episode strategic relevance amid Norway’s support for Ukraine, but the available evidence does not establish a state-directed operation. The absence of a reported intrusion or data exposure narrows the immediate risk to service disruption rather than compromise of government systems or citizens’ information.

What changed

Digdir reported that the affected services had been stabilised, shifting the confirmed picture from an active availability attack to residual disruption and continuing mitigation.

Impacts

Military & Security

The attack disrupted shared public-sector digital services and tested Norway’s cyber resilience, but Digdir reports stabilisation and no indication of a systems breach or personal-data exposure.

Political Stability

Residual disruption to common public-service functions can affect confidence in state digital delivery, although Digdir says it largely maintained availability during the attack.

Diplomacy

The group’s unverified Ukraine-related rationale may heighten scrutiny of cyber pressure linked to Norway’s security support for Ukraine, but no official attribution establishes a Russian or state role.

What to watch

• Do Digdir’s subsequent service updates confirm that residual disruption has ended and mitigation measures are no longer required?
• Do Norwegian authorities publicly attribute the attack using verified technical evidence, or identify further targeting of shared public-sector services?

Evidence and uncertainty

Moderate confidence. Moderate confidence. 3 retained references from 3 reporting origins (Associated Press, Norwegian Digitalisation Agency (Digdir), The Record). Claim-level independent corroboration has not been established. Confidence concerns the evidence for the reported development, not the probability of an outlook.

Useful context

Digdir

Norway’s Digitalisation Agency, which operates and supports shared digital solutions for the public sector.

It is the operator reporting on the attack response, service status and absence of a detected breach.

DDoS

A distributed denial-of-service attack, in which traffic is directed at online services to impair their availability.

Digdir classified the incident as a DDoS attack rather than an intrusion into systems.

Server Killers

A group that publicly claimed responsibility for the attack.

Its asserted motive and responsibility have not been verified by Norwegian authorities.

Geographic context

Sources

1. Pro-Russian hackers claim responsibility for major cyberattack on Norway's public digital servicesAssociated Press · 26 August 2026
2. Digdir stabiliserer løsningene etter dataangrepNorwegian Digitalisation Agency (Digdir) · 25 August 2026
3. Large DDoS attack knocks Norwegian public services offlineThe Record · 25 August 2026