Large DDoS attack knocks Norwegian public services offline

Large DDoS attack knocks Norwegian public services offline

A handful of Norwegian government services have been disrupted for more than a day after a large-scale cyberattack targeted the infrastructure used to operate them, authorities said.

The Norwegian Digitalisation Agency, known as Digdir, said the distributed denial-of-service (DDoS) attack began Monday and targeted the infrastructure of its IT partner, Vivicta. Such attacks flood servers with traffic in an attempt to make them unavailable to legitimate users.

Digdir said it was working with Vivicta to stabilize the affected systems, with some services gradually coming back online. The attack has continued for around 30 hours at varying levels of intensity and, as of Tuesday morning, was still affecting some services, according to Digdir's status page.

The incident disrupted 10 digital services used for verifying people's identities, logging into public services, exchanging data and documents between government agencies and businesses, accessing public records, and managing employee access.

Among the affected systems was ID-porten, a digital identification service that acts as a gateway to thousands of Norwegian government services. It allows people to verify their identity using services such as BankID and MinID and has more than 4.5 million users.

The disruption also affected parts of Norway's health infrastructure because several health services rely on ID-porten for authentication. Authorities warned of possible problems accessing online pharmacies and Norway's electronic prescription system.

It is the third DDoS incident to affect Digdir's services since June, according to Norwegian media.

"What is special about this latest attack, which has now been ongoing for a day, is that it is two to three times larger than what we experienced last time," Digdir press officer Are Kvistad told Norwegian public broadcaster NRK.

It was not immediately clear who was behind the attack or whether the recent incidents were connected or part of a broader campaign targeting Norway.

Digdir said the attackers had not gained access to sensitive information stored in the affected systems.