Report after denial of service attack

This is an open report ("post mortem") following the denial of service attack against ID-porten on August 24-26.

‌

The attack

From 03:38 on Monday, August 24, to Wednesday, August 26, at 19:30, several of Digdir's shared solutions were partially or completely unavailable for periods due to a distributed denial of service (DDoS) attack. DDoS attacks overload digital services with artificial network traffic to make them unavailable.

The attack targeted ID-porten. This was the third denial of service attack against ID-porten in nine weeks. The attack was two to three times more powerful than previous ones.

ID-porten and several other of Digdir's joint solutions are operated on a common operating platform with our operating partner Vivicta. The attack therefore also affected eFormidling, ELMA, the Contact and Reservation Register, eInnsyn, Maskinporten and Ansattporten. Altinn, eSignering and Digital mailbox for residents were also affected as a result of login via ID-porten being temporarily unavailable.

Course of events and measures

The incident started at 03:38 on August 24, and Digdir confirmed in a status message at 08:11 that it was a denial of service attack. Continuous measures were taken along the way to reduce the scope of the attack and stabilize the solutions, in cooperation with Vivicta. From 07:20 the same day, there was increased stability and availability again in all of Digdir's shared solutions.

The DDoS attack came in waves and the attack pattern changed along the way. From 13:20 to 14:15 on August 24, several of Digdir's shared solutions were again unavailable. On Tuesday, August 25, there were particular challenges with eSignering, which remained unavailable until 01:42 on Wednesday night. On Wednesday, August 26, the solutions were still stable, and at 19:30 the attack was over. Digdir chose to keep the restrictions that had been implemented until the next day while monitoring the situation.

Although the denial of service attack was both more powerful and longer-lasting than previous attacks, the measures contributed to the solutions being largely available during the incident. Traffic in Norway was, with some exceptions, stable throughout the entire period. Measures that were implemented led to periodic restrictions on traffic through the ID-porten from abroad. On 27 August at 09:00, Digdir confirmed via a status message that the attack was over, and at 14:50 that the shared solutions were back in normal operation. Until 2 September, problems could be experienced with logging in to the ID-porten from abroad.

The Norwegian Data Protection Authority and the National Security Authority (NSM) were notified in accordance with current procedures.

There are no indications that the incident has resulted in personal information being compromised.

The entire incident is being reviewed in line with Digdir's routines and practices. Attack methods are continuously evolving, and handling this type of attack requires ongoing adaptations. Digdir is working closely with operating partners to improve incident handling and, to the greatest extent possible, protect ourselves against similar attacks in the future.

The incident has been resolved.

A postmortem of the incident will be published at a later date.

All solutions now work as normal.

There are still some operational disruptions related to traffic from abroad, which we are continuing to work on resolving.
We continue to monitor the situation and update as necessary.

Status 09:00

This indicates that the attack has ended. Our solutions have largely functioned as normal throughout the night, and traffic is picking up as usual throughout the day. Only some traffic from abroad has still experienced operational disruptions as a result of the attack. We have maintained our contingency measures throughout the night as an insurance policy, and will continue to monitor the situation throughout the day.

The attack began on Monday night at 03:38 and stopped at 19:30 on Wednesday evening. With the exception of short periods, the ID-porten and shared solutions have been available at all times. We expect to return to normal operations within the next few days.

Update 23:00

The solutions are still in stable operating status.

The ID-porten still has limitations.

The next scheduled status update is tomorrow morning at approximately 09:00.

The solutions are still in stable operating status.

The ID-porten still has limitations.

The next scheduled status update is approximately 11 p.m.

The solutions are still in stable operating status.

The ID-porten still has limitations.

The next scheduled status update is approximately 9 p.m.

The solutions are still in stable operating status.

The ID-porten still has limitations.

The next scheduled status update is approximately 6 p.m.

The solutions are still in stable operating status.

The ID-porten still has limitations.

The next scheduled status update is approximately 3 p.m.

Update 10:55

Still stable operating status.

The ID-porten still has limitations.

The next scheduled status update is at approximately 1 p.m.

Update 09:05

The attack has continued throughout the night, but the solutions have been stable.

The ID-porten still has limitations.

Next update will be around 10:30

Update 01:40

The attack has been going on for most of the day, except for a short break.

The eSignering suppliers have taken measures to ensure that this service is now functioning normally again.

ID-porten still has limitations and we know that it already is, and is starting to become critical for several customers and services. Unfortunately, we do not have an estimate for when we can release even more.

Thank you for your patience, we will continue with status updates tomorrow.

Update 22:13

We have nothing new to report right now. A short summary of the day will be coming soon.

Update 19:07

There was a short pause in the attack before it started again with the same strength at approximately 5:15 p.m.

Otherwise, the situation is the same for all solutions.

The next scheduled status update is at 10 p.m.

Update 17:13

Still the same status as it has been for a while.

The ID-porten still has the same limitations.

eSigning is unavailable due to the limitations in the ID-porten. You can still create signing assignments, but it is the signing itself that is unavailable.

The next scheduled update is at 7 p.m.

Update 2:00 PM

The ID-porten still has the same limitations.

eSigning is unavailable due to the limitations in the ID-porten. You can still create signing assignments, but it is the signing itself that is unavailable.

We can also inform you that measures have been taken to help those who have had connection problems with ELMA and Maskinporten. We have received confirmation from several customers that it is now working again.

Update 12:00

The ID-porten still has the same limitations.

eSigning is unavailable due to the limitations in the ID-porten. You can still create signing assignments, but it is the signing itself that is unavailable.

The machine port should function as normal.

We have made some updates on the status of our solutions.

The ID-porten still has the same limitations.

eSigning is unavailable due to the limitations in the ID-porten. You can still create signing assignments, but it is the signing itself that is unavailable.

The machine port should function as normal, but we have received some indications from customers who are still having problems with connectivity or increased response times. We are looking into this together with the operating partner.

The next scheduled update will be at 12:00.

Update 09:30.

Still the same status for ID-porten. We will update info about the other solutions soon.

The attack has been going on throughout the night and is still ongoing.

The status of the solutions is the same as we ended yesterday. It works for many, but there are still many who are experiencing problems.

Next update will be around 09:30

Some measures that worsened the situation for our solutions have been reversed.

We are back to the same status as around 9 p.m. This means that it works for many, but there are also many who are still experiencing problems.

The attacks are still ongoing, so we are going into the night with the restrictions that have been in place for most of the day today.

There will be no more updates during the night.

Thank you for your patience.

Update 22:01

We are experiencing a worsening of the situation.

Update 21:13
The common solutions are still stable, but with the same limitations as at 4 p.m.

We will provide a new status update before 11 p.m.

Update at 4 p.m.:
The attack is still ongoing, but the solutions are stable with the limitations that have been set.

We know that some people are still experiencing problems, and we are continuously assessing when we can relax certain restrictions.

We are seeing some improvement again from around 2:14 PM. However, there will be some customers and services that will still experience operational disruptions and problems connecting.

We are seeing a deterioration in several solutions again.

As of 12:20, we see that it is stabilizing again. We are aware that there are still services and customers experiencing operational disruptions.

Next scheduled update is approximately 1:30 PM.

We are seeing a deterioration in the ID portal, the Employee portal, the Contact and Reservation Register.

The solutions still appear stable, but we are aware that some customers and services are still affected by the measures that have been taken.

Next scheduled update is approximately 1:30 PM.

We are seeing increased stability and availability in all solutions from approximately 08:50.

The next status update will be at 11:30 unless there are any major changes before then.

Our operating partner Vivicta confirms that this is a denial of service attack. We have been working closely with Vivicta on stabilizing measures since the attack began, and are now experiencing improvement. As of 07.25, the solutions are on the way up, and more people are able to log in via the ID-porten. We are continuing with additional stabilizing measures, and continue to monitor the solutions.

Update as of 07:28

We are experiencing increased availability of the solutions from 07:25. However, some people may still experience problems.

Update at 06:41

Digdir's shared solutions have been unavailable since 03:38. This applies to the ID portal, the Employee portal, the Contact and Reservation Register, My ID, the Maskin portal, eFormidling, eInnsyn, ELMA, Self-service.
Altinn, eSignering and Digital mailbox for residents are also affected, as a result of login via the ID-porten not being possible.
The same applies to logging in to public institutions that use the ID-porten. For some services, such as Health Norway, you can use a mobile app to log in.
We are working with our operations provider Vivicta to resolve the issues as quickly as possible.

Update as of 05:48

We are still experiencing problems with several solutions. This applies to the ID-porten, the Contact and Reservation Register, the Machine Porten, MinID, eFormidling, ELMA, eInnsyn, the Employee Porten, Self-Service Solutions, Altinn.

The problems occurred from 03:38

Update at 04:51.

We are still experiencing problems with multiple solutions.

Applies to ID-porten, Contact and reservation register, Maskinporten, MinID, eFormidling, ELMA, eInnsyn, Ansatporten, Self-service solutions, Altinn