Loading story…
Norway’s implementation of the national Security Act has lagged years behind plan, leaving parts of the country’s critical digital and physical infrastructure without the intended protections. The law entered into force in 2019 and requires authorities to identify fundamental national functions, map dependencies, and bring critical entities under stricter security oversight, but work that was due by July 2021 remained unfinished amid coordination problems across ministries and sectors.
Public criticism has intensified as the Office of the Auditor General and industry voices warn that slow execution is weakening national digital resilience. Reported obstacles include limited capacity, shortages of specialist competence, and sector-specific disputes over scope; one example cited is that Norway’s oil and gas infrastructure was only later recognized as falling under the act, underscoring how delays in classification and coordination have left important value chains insufficiently protected.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Infrastructure related to Norway's oil and gas sector was only recognized last year as falling under the Security Act, illustrating delays caused by sector-specific considerations.
The work to identify fundamental national functions and dependencies was supposed to be completed in July 2021, but the process was not finished by that deadline.
Norway's Security Act entered into force in 2019, establishing the legal framework for identifying and securing critical infrastructure and other entities of national importance.
The Norwegian Office of the Auditor General stated that progress on identifying and securing critical infrastructure in the civil sector was too slow, while key implementation work remained unfinished.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
mnemonic.io
Open sourceikt-norge.no
Open sourcelovdata.no
Open sourceriksrevisjonen.no
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale **distributed denial-of-service (DDoS)** attack disrupted Norway’s shared government digital infrastructure by targeting systems operated for the Norwegian Digitalization Agency (**Digdir**) by its IT partner **Vivicta**. The attack began early Monday and continued for about 30 hours at varying intensity, knocking multiple public services offline or degrading performance with failed connections, slow responses, and long login times. Authorities said around 10 services were affected, including **ID-porten**, Norway’s key digital identity gateway, as well as **eSignering**, with downstream disruption reported for platforms such as **Altinn** and **Skatteetaten**. The outage also caused knock-on effects in parts of Norway’s health infrastructure, including online pharmacies and the electronic prescription system. Digdir said several services were fully unavailable for short periods and some remained partially inaccessible after stabilization efforts. Norwegian authorities, including the National Security Authority and Data Protection Authority, were notified, and officials said there was **no indication of unauthorized access, security breach, or compromise of personal data**. Digdir described the incident as significantly larger than recent attacks and said it was the third DDoS campaign to hit the agency in recent months.
Aug 28, 2026
Norwegian authorities publicly attributed a series of intrusions and espionage activity against multiple Norwegian organizations to **Salt Typhoon**, a China-linked threat actor assessed to be operating on behalf of Chinese government interests. Norway’s Police Security Service (PST) said the actor gained access by **compromising vulnerable network devices**, marking one of the clearest acknowledgements from a European government that the campaign has extended beyond previously reported activity in North America. Norway’s assessment described Salt Typhoon as an example of how **private Chinese cybersecurity contractors** can augment Chinese security and intelligence services, and warned that Chinese cyber operations will remain a major intelligence threat to Norway in 2026. Reporting also tied Salt Typhoon to a broader pattern of stealthy targeting of **critical infrastructure**, including past allegations of compromises of telecommunications providers in the U.S. and Canada where communications of senior politicians were reportedly intercepted, increasing pressure on telecom operators to harden network security.
Jun 29, 2026
Norway’s Police Security Service (PST) reported that the China-linked espionage actor tracked as **Salt Typhoon** compromised *vulnerable network devices* at multiple Norwegian organizations, marking Norway as the latest country to publicly confirm Salt Typhoon-related intrusions. The disclosure appeared in PST’s 2026 annual threat assessment, which characterized Norway’s security environment as exceptionally severe and highlighted foreign intelligence pressure. PST assessed that China’s primary intelligence threat to Norway is in the cyber domain and warned that Chinese services are expected to continue mapping Norwegian digital infrastructure and collecting intelligence, alongside other hybrid tactics. Reporting also reiterated allied government assessments that **Salt Typhoon** has historically focused on telecommunications and other critical infrastructure internationally, including incidents in North America where U.S. officials said the campaign enabled interception of communications tied to senior political figures.
Jun 29, 2026