Major DDoS Attack Disrupts Norwegian Government Services
In a significant cybersecurity incident, the Norwegian government’s digitalization agency, known as Digitaliseringsdirektoratet (Digdir), has reported major disruptions to its services due to a Distributed Denial of Service (DDoS) attack. This attack, which began on Monday, August 21, 2023, at approximately 3:38 AM local time, has caused a wide range of operational impacts across essential governmental services.
Digdir outlined in a public update that the DDoS assault has considerably hampered several vital systems. Users have encountered difficulties accessing the ID-porten identity gateway, which is critical for digital identification; the Contact and Reservations Register; and the Maskinporten authentication hub, which facilitates machine-to-machine communications. Additional services affected by the attack include the e-ID solution MinID, the eFormidling message exchange platform, the ELMA business address register, the eInnsyn search service, as well as the Employee Portal and Self-Service Solution. Notably, the Altinn portal, a key platform for business communications, and the eSignering digital signature service, along with the Digital Mailbox, have also experienced severe availability issues.
Throughout the attack, which has made some services entirely inaccessible at times, users have reported that accessing the affected sites has generally taken longer than usual. Despite these issues, Digdir confirmed that its team has been actively collaborating with its subcontractor, Vivicta, to mitigate the impact of the attack and bolster defenses.
As of the latest reports, while most services are stabilizing, the agency has acknowledged that some are still experiencing disruptions. The ID-porten remains partially inaccessible, as noted in their most recent status update. "Our digital joint solutions are used by the entire public sector in Norway, and it is serious when we experience that the solutions are not available or there are major operational disruptions," stated Frode Danielsen, the director of Digdir. He emphasized that the primary objective of such DDoS attacks is to hinder service availability, rather than infiltrate systems. Fortunately, there are currently no signs that the attack led to a breach of security or compromise of personal data.
The recent surge in DDoS attacks against Digdir highlights a troubling trend; this incident marks the third occasion within a short timeframe that the agency, along with Vivicta, has been targeted. Cybersecurity experts are increasingly concerned about this repeated targeting, especially given the implications for national infrastructure. "There are legitimate reasons to funnel an entire country’s public services through a single authentication gateway," noted Denis Calderone, the COO of AI security firm Suzu Labs. He explained that such a concentration allows for streamlined policy enforcement and logging, but carries the inherent risk that this single entry point can become a critical vulnerability.
Further investigation into the nature of these attacks has led some industry leaders to draw parallels with governmental disruption tactics often associated with state-sponsored initiatives. Kevin Surace, the CEO of Token, an authentication specialist, pointed out the telling characteristics of the attacks. He remarked, "Attackers don’t have to break into government systems to disrupt a country; keeping people from getting in is enough." This underscores a growing awareness of the need for robust cybersecurity protocols that can withstand adversarial attempts to compromise critical infrastructure.
Norway, with a population of under six million, has faced various cyber threats in the past. Notably, in July 2023, a serious cyber-espionage incident impacted twelve ministries and was linked to exploitation of a vulnerability in Ivanti software. This incident was attributed to suspected Chinese threat actors, highlighting the multifaceted nature of cyber threats facing the nation. Additionally, prominent private sector organizations in Norway, including the recycling company Tomra and the aluminum manufacturer Norsk Hydro, have also confronted ransomware attacks, further underscoring the urgency for comprehensive cybersecurity measures.
As the Norwegian government grapples with the ramifications of this DDoS attack, Digdir’s commitment to implementing enhanced security protocols remains crucial. In an era where cyber threats are becoming increasingly sophisticated and common, safeguarding digital infrastructure will be vital for providing uninterrupted public services and maintaining national security.