Updated 27 Oct, 17:08
Norway's National Security Authority (NSM) raised the national cyber risk level to high on Tuesday, the second-highest level on its five-point scale. It is the first time the authority has made its assessment public, according to Dagbladet and Aftenposten.
It is the second-highest level on this scale," director Arne Christian Haugstøyl said.
The scale runs from very low to extremely high, and moderate is considered the normal level. NSM said the decision follows the security policy situation and events of recent months. "A high risk level requires Norwegian businesses to implement preventive measures immediately," the authority said in a press release.
Haugstøyl said NSM has seen a tripling of successful cyber operations against Norwegian companies. Several had serious consequences and still carry damage potential for national security, he said. "Businesses that have not previously had access to classified information now get a clear message to implement measures," he said.
He pointed to the data breach at Lørenskog municipality earlier this year, where large amounts of data were stolen and sold on the dark web, similar to the Telia case earlier this year, VG reported. NSM also cited the rapid development of artificial intelligence, which makes advanced digital attacks easier, and newly discovered security holes in the programming language PHP, used on an estimated 70 percent of the world's websites. According to NSM, foreign states increasingly use cyberattacks, and experience from the war in Ukraine shows cyber operations have become a central part of modern hybrid warfare.
NSM presented 21 measures it expects Norwegian businesses to introduce. It named particularly exposed areas: the defence sector and defence industry, service providers and supply chain companies to businesses covered by the security law, and businesses managing critical societal infrastructure. Haugstøyl warned that attackers target subcontractors, often small companies, and use that access as a springboard.
Justice and Emergency Preparedness Minister Astri Aas-Hansen (Ap) said the raised assessment underlines the seriousness of the situation. "I encourage all businesses to review how good their IT security is and quickly implement measures to close vulnerabilities," she said. She pointed to cybersjekk.no and sikkert.no for guidance.
The government proposes strengthening NSM with 180 million kroner in its 2027 budget proposal, and wants to build a new professional environment for AI security.
What to do
- Official preparedness advice: DSB, sikkerhverdag.no.
- Emergency: 112 (police), 110 (fire), 113 (ambulance).