Norway's shared login layer failed for the third time since June, and nobody broke in

Nobody had to touch Altinn or Skatteetaten to give their users login failures. Both posted notices about login problems and pointed at Digdir's status page ^[4]. Norwegian health services that authenticate through ID-porten were pulled in as well, with authorities warning about access to online pharmacies and the electronic prescription system ^[15]. Earlier attacks this summer reached Helsenorge, NAV and Skatteetaten by the same route ^[10]. ID-porten is the gateway to thousands of Norwegian government services and has more than 4.5 million users ^[14]. Fan-out on that scale makes the login layer the cheapest thing in the country to jam.

The interval is more instructive than any single outage. Digdir had normal operations back the day after the 3 August attack and said it would review the incident with Vivicta and other partners ^[16]. Twenty-one days later the same infrastructure was under attack again ^[18]. Whatever the review concluded, it did not change the answer to a bigger flood.

June is the tell for targeting. That attack went at ID-porten through Vivicta's network infrastructure and temporarily took MinID, Maskinporten, eInnsyn and eFormidling with it ^[17]. The concentration point was found on the first attempt, and there has been no reason to look elsewhere since.

The mitigation record is genuinely good, which is the trap. In securityaffairs' account, complete unavailability came only in short bursts, with the rest of the damage showing up as failed connections, slow responses and longer login times ^[9]. The Record put the attack at roughly 30 hours of varying intensity, still affecting some services on Tuesday morning ^[7], and BleepingComputer reported ID-porten and eSignering still partially inaccessible after most systems had been stabilised ^[8]. A day and a bit of degraded national authentication is not an outage anyone has to declare. It is also not a working service.

Digdir's disclosure is careful and, on what has been published, accurate: this is availability rather than intrusion, with no sign personal data was touched, and both NSM and Datatilsynet notified ^[3][11]. That accuracy is also why the incident generates so little friction for whoever is sending the traffic. There is nothing to prosecute and nothing exfiltrated, so the entire bill sits with Digdir, its operations provider and the agencies queued behind them.

Which leaves a measurement gap. Digdir reports these events service by service, stabilised or not, and that framing flatters the response every time. The number that would describe the actual damage is user-minutes of failed authentication across an account base of 4.5 million ^[14], and nobody has published it for June, for 3 August, or for this week. Until someone does, the case for putting one agency and one provider behind every citizen-facing login will keep being argued on cost per transaction, because that is the only column with figures in it.