Onitio

Norway's cyber risk level raised to HIGH: what NSM is saying, and why

Hands typing on a backlit keyboard glowing pink, illuminated by blue and orange light.

On Tuesday 27 October, the Norwegian National Security Authority (NSM) raised the national cyber risk level to HIGH, the second highest of five levels. It is the first time NSM has published the level at all. Alongside it, NSM released a package of measures it expects every Norwegian business to read and act on, from retail chains and offices to hotels and transport operators.

NSM director Arne Christian Haugstøyl said the agency is going public with the assessment because Norwegian businesses urgently need to become more resilient, and better at handling attacks when they happen.

Why NSM raised the level

NSM gives three main reasons:

  • A sharp rise in successful attacks. Over the past six months, NSM has seen successful cyber operations against Norwegian businesses triple. According to Haugstøyl, several have had serious consequences and still carry a potential for harm to national security.
  • Sustained pressure on exposed sectors. Defence, the defence industry, the space sector, critical infrastructure, and service providers to organisations that matter for national security face reconnaissance, attempted and successful compromises, ransomware, and denial-of-service attacks.
  • Faster attacks through AI. NSM says language models and agentic AI used in cyber operations pose a serious risk. While this has not yet been documented in Norway, the potential for harm already affects the level. Haugstøyl says AI finds vulnerabilities faster than people can, so attacks become more frequent and greater in volume, and security work has to speed up to match. He also warned that we should assume information already on the dark web will be misused, because it doesn't disappear.

Haugstøyl pointed to recent Norwegian cases: the breach at Lørenskog municipality, where large amounts of data were stolen and later sold on the dark web, and the breach at Telia earlier this year. He also cited critical flaws found in PHP the week before the announcement. PHP runs an estimated 70 per cent of the world’s websites. Some attacks have been stopped, and others carried out, that cannot be discussed publicly, he told Nettavisen. And in August, a pro-Russian group claimed the largest denial-of-service attack Norway's public digital services have recorded.

It doesn't stop at critical infrastructure

Defence, space, and critical infrastructure are the most exposed, but NSM is explicit that the risk reaches further. Cyber operations also hit suppliers and subcontractors, as a way into organisations further up the chain. That is why the package is addressed to every Norwegian business.

Recent attacks show how quickly an incident reaches the shop floor, the terminal, or the office. In mid-October, two weeks before NSM's announcement, attackers took over the refrigeration systems in hundreds of French supermarkets, including Intermarché, Carrefour, and Coopérative U. Fridges and freezers heated up overnight, fresh and frozen food had to be thrown out, and several stores had fires. The same weekend, Ahold Delhaize, which owns Albert Heijn, Delhaize, and Stop & Shop, took systems offline after a cyberattack. Websites and apps were down across Europe and the US for more than a week, and some Albert Heijn stores were left with empty shelves while distribution recovered. Across Europe, check-in and boarding systems failed at Heathrow, Brussels, and Berlin airports in September 2025. And in Sweden, an attack on a single data centre took down systems ranging from government payroll to cinema ticket sales.

Closer to home, ransomware shut down Travel Retail Norway's back-office systems across four Norwegian airports, taking out self-checkouts, staff scheduling, and laptops. Read how TRN recovered.

In three of these attacks, the way in was a supplier, not the company itself. In France, it was refrigeration controllers from an equipment supplier, most of them older models that no longer received security updates: exactly the kind of device NSM now asks businesses to phase out.

“As a supplier with access to customer systems and information, we have a particular responsibility to maintain strong security. Our information security management system is certified to ISO 27001. We monitor threats and vulnerabilities continuously, run regular security awareness activities, and have established incident response capabilities. We are reviewing access rights, endpoints, and exposed systems, and taking vulnerable technology out of service when it cannot be adequately secured. The higher national risk level makes that work more urgent. Security has to be continuously managed, tested, and improved.”

Øystein Tveitå, Chief Information Security Officer (CISO), Onitio

What NSM asks businesses to do

NSM stresses that the measures are not new. Most are already in its basic principles for ICT security. The package highlights, among other things:

  • phishing-resistant multi-factor authentication
  • hardening systems, and good logging and detection
  • security updates, and phasing out devices that can no longer be updated
  • mapping devices, software, and digital supply chains
  • access control, and dividing networks by risk
  • regular backups, and testing that they can be restored
  • a plan for handling security incidents
  • checking that security measures are in place and actually work

There are new legal obligations too. Under the Digital Security Act, in force since October 2025, providers of essential services must notify the authorities of serious incidents within 24 hours, including incidents that happen at a supplier.

NSM suggests starting with Cybersjekk, a self-assessment that gives a picture of where a business stands and what to tackle first. The measures don't remove risk completely, but they improve a business's ability to handle an attack and limit the damage.

“Most businesses know which security measures should be in place. The challenge is making sure they are implemented, monitored, and working as expected. That’s where Onitio comes in, by continuously running, monitoring, and improving our customers’ critical IT environments. If you’re unsure where to start, or something in your systems doesn’t look right, call us. Our service desk is open around the clock, and our own people can help you work through NSM’s measures.”

Pernille Tolsrød, Operations Director, Onitio

Read more (all in Norwegian)