Norway’s DDoS Incident Stabilizes, but ID-porten Restrictions Continue

Norway’s Digdir DDoS incident remains open, but services are largely stable. ID-porten restrictions continue while eSignering and other listed components are operational.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

A blue digital identity gateway and mostly green public-service nodes sit behind layered shields while an orange traffic flood is diverted; one amber identity node remains restricted.
Original editorial illustration of a mitigated DDoS event with one remaining restricted identity service. It does not depict a victim, attacker or confirmed data compromise.

Status update • Norway digital services

Norway’s Digdir DDoS incident remains open, but the latest official update says operations are stable. ID-porten still has restrictions, while eSignering and the other listed Digdir components are marked operational. Norway’s health-network status page likewise reports normal operation under mitigations and says its eSignering workflow is functioning again.[1][2]

Digdir incident

Open: identified
Vendor impact label remains critical; no resolution time is recorded.[1]

Remaining restriction

ID-porten: partial outage
Latest update says restrictions continue.[1]

Recovered surfaces

eSignering: operational
Other listed Digdir components are also operational.[1]

Evidence boundary

Digdir confirmed a denial-of-service attack earlier in the incident. Current public records do not identify an attacker, establish data theft, quantify affected users or prove a connection to any Treasure Coast organization.[1][3]

What the latest official status says

Digdir’s 11:00 PM CEST update on August 26 says operations remain stable and ID-porten still has restrictions. The incident object remains identified, retains a critical impact label and has no recorded resolution time.[1]

Component status is more specific than the global incident label: ID-porten is marked partial_outage; eSignering, Altinn, MinID, Maskinporten, eFormidling, eInnsyn, Ansattporten and the other listed components are marked operational.[1]

The health-service dependency is stable

Norsk helsenett’s related incident remains in monitoring with minor impact, but its latest update says signing agreements through Helsenettet.no with eSignering should work again. Helsenorge, Kjernejournal portal, eFORSK and ePROM are all marked operational.[2]

That is not the same as declaring the broader Digdir incident resolved. It means the named health-service dependency is currently operating under mitigations while Digdir continues to track restrictions on ID-porten.[1][2]

How the incident developed

  • August 24Digdir’s incident record was created during the disruption. Its historical updates attribute the event to a denial-of-service attack and describe stabilization work with operating partner Vivicta.[1]
  • August 25Independent reporting documented disruption to public-service authentication and health-service dependencies while systems gradually returned.[3][4]
  • August 26Digdir repeatedly reported stable operations but continuing ID-porten restrictions. Norsk helsenett reported normal operation under mitigations and later said its eSignering workflow was functioning again.[1][2]

What users may still experience

Because ID-porten is a shared identity gateway, restrictions can appear as failed or delayed sign-ins even when the destination service itself is operational. An intermittent login success is not proof that every dependency has fully recovered.[1][3][4]

Users with time-sensitive Norwegian public-service work should check Digdir’s live incident record before relying on ID-porten. Preserve transaction or signing references if a workflow fails, and use only continuity channels already published by the responsible service provider.[1][2]

What this does not mean

  • The open critical incident label does not mean every listed government service is currently down.[1]
  • A DDoS availability attack does not by itself establish access to confidential records or alteration of data.[1][3]
  • No official source in this review attributes the incident to Russia or any other actor.[1][3]
  • No direct Florida or Treasure Coast impact has been established.[1]

Practical continuity steps

  1. Check the live Digdir status before ID-porten-dependent work.[1]
  2. If a transaction fails, record the time, destination service and transaction reference before retrying.
  3. For health-service access, follow Norsk helsenett or the responsible care provider’s approved continuity instructions rather than assuming records are lost.[2]
  4. Do not act on unsupported attacker attribution or unsolicited payment demands.

Bottom line

The incident has moved from broad disruption toward stable operation, but it is not closed. The clearest remaining public restriction is ID-porten; eSignering and the other listed Digdir services are currently operational. Readers should use the status pages—not stale screenshots or social posts—for time-sensitive decisions.[1][2]

Sources

  1. Digdir — Production incident d7tgwqgzd742
  2. Norsk helsenett — Related incident 2ch26kgq7p6z
  3. The Record — Large DDoS attack knocks Norwegian public services offline
  4. BleepingComputer — Massive DDoS attack disrupts Norway’s government digital services

Reporting cutoff: August 26, 2026, 7:48 PM EDT / 2026-08-26T23:48:54Z. Status can change after publication; follow the two official incident records for the newest operational state.

Browse Articles

Latest Articles