In a nutshell: Norwegian authorities have officially attributed a recent cyberattack on a dam in Bremanger, Norway, to Russia, raising concerns over sabotage targeting critical infrastructure across Europe. The incident marks the first time Oslo has formally linked such an attack to pro-Russian actors.
In April, hackers remotely accessed the Bremanger dam's digital controls, which manage fish farming operations, and opened a valve. Reuters notes that the attack released 132 gallons of water per second for four continuous hours before authorities detected and stopped the breach.
While authorities report that no injuries or material damage resulted from the two-million-gallon deluge, intelligence agencies said the operation was part of a broader campaign aimed at intimidating and unsettling the general population
"Our Russian neighbour has become more dangerous," said Beate Gangås, head of Norway's Police Security Service, who spoke at a briefing on hybrid attacks.
Technical evidence of the attack appeared in a three-minute video posted to Telegram, watermarked with identifiers of a pro-Russian cybercriminal group. Police attorney Terje Nedrebø Michelsen confirmed the video's authenticity to the Norwegian Broadcasting Corporation (NRK), noting that while similar propaganda has circulated on social media, this incident represents the first confirmed breach of Norway's water infrastructure since 2022.
Kripos, Norway's organized crime unit, told national newspaper Aftenposten that the group behind the attack consists of multiple affiliated actors who have carried out several cyber operations against Western businesses in recent years. The authorities did not provide further details, leaving the specific identities of those involved unclear and underscoring the challenges of attributing cyberattacks with certainty.
Western intelligence officials have warned that sabotage campaigns attributed to Russia are becoming increasingly reckless, citing incidents of vandalism, arson, attempted assassination, and cyberattacks since Moscow's full-scale invasion of Ukraine. Last year, Britain's MI6 chief, Richard Moore, described Russia's actions as a "staggeringly reckless campaign" intended to deter European support for Ukraine, a claim Moscow continues to deny.
The Russian embassy in Oslo quickly rejected the accusations, calling them "unfounded and politically motivated" in an emailed response to Reuters. It also claimed that allegations of Russian sabotage represented a "mythical threat" concocted by Norwegian authorities in their annual February security report.
Norway is a leading gas exporter that relies primarily on hydropower for electricity and shares a 123-mile Arctic border with Russia. Intelligence services have repeatedly warned of risks to national infrastructure and power generation, highlighting the growing sophistication of foreign cyber operations. Gangås told NRK that state actors often use proxy groups to demonstrate their capabilities and then publicize these actions online, as if to say, "look what we can do if we want to."
At a recent briefing titled "Hybrid attacks against Norway: are we at war?", Gangås urged the public to stay vigilant, emphasizing that such cyber threats are likely to become more frequent in Norway and across Europe.
"I want Norwegians to be prepared," she said.
Hackers unleash torrent from Norwegian dam, releasing 132 gallons per second for four hours
