Norway Reports Record Increase in Data Breaches Linked to Deliberate Cyberattacks

Key Takeaways

• Record Increase in Cyberattack-Related Breaches: Norway's Datatilsynet received 282 notifications involving deliberate attacks in the first half of 2026, compared with 103 during the same period in 2025, an increase of approximately 174%.
• Second Quarter Sets New Record: The authority recorded its highest quarterly number of notifications involving deliberate attacks since it began tracking the category in 2023, even as overall breach reporting remained relatively stable.
• Supplier Attacks Affect Multiple Organizations: Intrusions involving shared technology providers in the education and hospitality sectors exposed personal information belonging to numerous customers, generating multiple breach notifications.
• Data Controllers Retain Legal Responsibility: Under the GDPR, organizations must assess the security of their processors and meet applicable breach notification obligations, even when an incident originates with an external supplier.
• Notifications Do Not Represent Separate Attacks: Datatilsynet cautioned that a single supplier compromise can affect numerous organizations, meaning the increase in notifications does not necessarily reflect a corresponding rise in distinct cyberattacks.

Deep Dive

Norway's data protection authority received 282 reports of personal data breaches linked to deliberate cyberattacks in the first half of 2026, up from 103 during the same period last year, as intrusions at shared technology suppliers exposed information belonging to multiple organizations.

The 174% increase was particularly pronounced in the second quarter, when the Norwegian Data Protection Authority, Datatilsynet, recorded more notifications involving deliberate attacks than in any previous quarter since it began tracking the category in 2023.

The rise comes despite little overall change in the number of personal data breach notifications received by the regulator. Datatilsynet said an important explanation lies in attacks against service providers whose systems are used by numerous customers. One intrusion can compromise information held on behalf of many organizations, each of which may have a separate obligation to report the incident.

The authority cited two incidents earlier this year that illustrate the problem. During the spring, attackers gained access to a supplier of a learning platform used by educational institutions. The intrusion exposed personal information belonging to employees and students at numerous institutions using the service.

A separate attack during the winter affected a widely used technology provider serving the travel industry. Hotels subsequently submitted breach notifications after discovering that customer information had been compromised.

Neither supplier was identified in the regulator's account. Datatilsynet classifies deliberate attacks as incidents in which unauthorized parties attempt to steal, alter or delete data, or disrupt an organization's operations. Such attacks may be motivated by financial gain, espionage or efforts to undermine confidence in a service.

The authority said the first six months of 2026 produced the highest number of notifications involving deliberate attacks for any first-half period since it introduced the category.

The increase does not necessarily indicate a corresponding rise in the number of separate cyberattacks. Where a supplier serves dozens of organizations, a single intrusion can generate numerous reports.

When a Supplier Is Breached

The two incidents described by Datatilsynet demonstrate how an attack on one service provider can expose information belonging to organizations that were not themselves directly targeted.

The consequences can differ considerably between customers. Organizations using the same platform may store different categories of personal information, serve different groups of individuals and face different risks when that information is compromised. For this reason, Datatilsynet said, each organization must assess the consequences of a supplier breach in relation to its own processing activities.

Under the General Data Protection Regulation, organizations acting as data controllers remain responsible for meeting their data protection obligations when they use external processors.

Article 28(1) requires controllers to engage only processors providing sufficient guarantees that appropriate technical and organizational measures will be implemented to ensure compliance with the regulation and protect individuals' rights.

Those obligations extend to the selection and oversight of suppliers, including an assessment of whether their security arrangements are appropriate for the information they will process.

When a personal data breach occurs, the GDPR places separate notification obligations on processors and controllers. Processors must inform controllers without undue delay after becoming aware of a breach. Controllers must generally notify the relevant supervisory authority within 72 hours of becoming aware of an incident where notification is required, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.

An incident originating at a supplier can therefore require action from multiple customers, even where the technical failure occurred outside their own systems.

Datatilsynet has worked with the Norwegian National Security Authority, the Norwegian Digitalisation Agency, the Norwegian Association of Local and Regional Authorities, the Norwegian Directorate of Health and the Norwegian Agency for Public and Financial Management to develop joint recommendations on information security management and personal data protection.

The authority's latest figures show how extensively the consequences of a supplier intrusion can spread. A compromised platform may serve organizations with different responsibilities and different categories of personal information, leaving each to assess the exposure of its own records.

For Datatilsynet, the result has been a record number of reports involving deliberate attacks, although the number of separate intrusions responsible for those notifications remains unclear.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey