Norway NSM reports tripling of successful cyberattacks, per ETCISO

What happened

Norway’s National Security Authority (NSM) says the number of “successful” cyberattacks against organisations in the country tripled over the past year. ETCISO reported this in an AFP report published on 29 October 2026. According to the same report, this is the NSM’s first public evaluation of such risks.

NSM director Arne Christian Haugstoyl told a news conference: “Over the past year, we have observed a tripling of the number of successful cyber operations against Norwegian organisations.” He added that “several of them had serious consequences and continue to present a risk to national security,” according to ETCISO.

The report gives one example. ETCISO reports that in spring the municipality of Lorenskog, in Oslo’s suburbs, had a large amount of data stolen after a cyberattack, and that the data was offered for sale on the dark web. The source does not say what data was involved, how much was taken, how attackers got in, or whether the municipality has published its own statement.

According to ETCISO, Haugstoyl also said artificial intelligence gives perpetrators a powerful new tool. He said AI “allows data to be exploited and misappropriated at a professional level, on a scale and in greater ways than before.” The NSM rates the country’s cyber risk level as “heightened”, second on a five-point scale.

On attribution, ETCISO notes that several European countries have alleged Russia is behind a stepped-up hybrid warfare campaign that includes cyberattacks. The same report says the NSM did not identify any actors behind the attacks.

Several details are not confirmed by the source:

• The absolute number of attacks.
• The sectors affected.
• Any vulnerabilities or CVEs exploited.
• The attackers’ identity.

Am I affected?

• This is a national threat assessment, not a disclosure of a specific vulnerability. No product, version or CVE is named, so there is nothing to check against a version list.
• Organisations operating in Norway fall within the scope of the NSM’s assessment, according to ETCISO.
• Residents of Lorenskog, and organisations that share data with the municipality, may have a connection to the reported data theft. The data types involved are not confirmed.

What to do now

1. If you operate in Norway, read the NSM’s own published evaluation rather than relying on news summaries. The source does not link it.
2. If you have a relationship with Lorenskog municipality, watch for official notices from the municipality about the reported data theft. Its scope is not confirmed in the source.
3. Treat this report as context for your own risk review. It contains no specific patch, indicator or mitigation to apply.

Sources

• ETCISO: Norway reports sharp rise in ‘successful’ cyberattacks