A major DDoS attack on the Norwegian government’s digitalization agency has disrupted key services since Monday.
The agency, known as Digitaliseringsdirektoratet (Digdir), explained in an update on August 25 that the attack began on Monday night at 3.38am local time.
It impacted the ID-porten identity gateway, the Contact and Reservations Register, the Maskinporten machine-to-machine authentication hub, e-ID service MinID, the eFormidling message exchange, ELMA business address register, the eInnsyn search service, the Employee Portal, Self-Service Solution, the Altinn portal, eSignering digital signature service, and Digital Mailbox.
“The affected services have been completely unavailable for short periods. For most of the time, they have been partially available, but have experienced operational disruptions, where, for example, logging in has taken longer than usual,” Digdir said.
“Throughout the entire period, Digidir has worked together with subcontractor Vivicta on measures to protect the solution against the attack.”
Read more on DDoS attacks: Cyber-Attack Strikes Norwegian Government Ministries
Digdir said most services have now stabilized, although some are still experiencing operational disruption.
According to the latest status update, only the ID-porten was still partially inaccessible at the time of writing.
“Our digital joint solutions are used by the entire public sector in Norway, and it is serious when we experience that the solutions are not available or there are major operational disruptions,” explained Digdir director, Frode Danielsen.
“The purpose of this type of attack is to affect availability, not to break into the solutions. There are no indications that the attack has led to a security breach or that personal data has been compromised.”
Norway Under Fire
However, Digdir explained that this is the third time in a short period of time that it and subcontractor Vivicta have been hit with DDoS attacks.
"There are legitimate reasons to funnel an entire country's public services through a single authentication gateway. You get one place to enforce policy, one set of logs to monitor, one surface to harden,” explained Denis Calderone, COO at AI security firm Suzu Labs.
“The trade off is obvious though: that single entry point becomes the one thing you absolutely cannot let go down. And if you've made that architectural choice, you'd better have every DDoS defense in the book tuned and tested for that exact chokepoint.”
Kevin Surace, CEO of authentication specialist Token, said the attacks bore the hallmarks of a classic Russian disruption campaign.
"Attackers don’t have to break into government systems to disrupt a country,” he added. “Keeping people from getting in is enough."
Norway, a country of less than six million people, has been the target of cyber-attacks before.
In July 2023 a cyber-espionage incident impacting 12 ministries was traced to exploitation of an Ivanti zero-day vulnerability by likely Chinese threat actors.
Private sector firms in the country such as recycling giant Tomra and aluminium manufacturer Norsk Hydro have also been targeted by ransomware groups over the years.