Storting (Norwegian Parliament) email breach

In August 2020, the Storting — Norway's national parliament — suffered an intrusion into its email system that Norwegian authorities would later attribute to APT28 (Fancy Bear), a unit of Russia's military intelligence service, the GRU. The breach became one of the most consequential state-attributed cyber operations against a Western legislature, prompting a rare public naming of Russia by the Norwegian government.

What happened

On 24 August 2020, attackers brute-forced their way into a limited number of email accounts belonging to elected representatives and Storting employees. Brute-forcing — systematically guessing passwords against accounts that lacked sufficient protection — gave the intruders direct access to the contents of those mailboxes. Investigators later confirmed that data was stolen from each of the compromised accounts, though the parliament did not publish a precise count of affected individuals or volume of exfiltrated material.

The Storting disclosed the incident on 1 September 2020, describing it as a "significant" attack. Director Marianne Andreassen said the full scope was still being assessed.

Attribution

Norway moved unusually quickly to attribution. On 13 October 2020, Foreign Minister Ine Eriksen Søreide stated that the attack was the work of Russia, calling it "a very serious incident affecting our most important democratic institution." Russia's Foreign Ministry dismissed the accusation as a "planned provocation."

In December 2020, the Norwegian Police Security Service (PST) concluded its investigation, assessing that the operation was likely conducted by APT28 / Fancy Bear, linked to the GRU's 85th Main Special Service Centre (GTsSS) — the same unit indicted by the U.S. for operations against the 2016 election and the World Anti-Doping Agency. PST noted the Storting intrusion was part of a larger campaign running nationally and internationally since at least 2019.

Impact

• Email accounts of an undisclosed number of MPs and staff were accessed, with data exfiltrated from each.
• The breach forced a parliament-wide credential reset and a hardening of authentication, including accelerated multi-factor adoption.
• It became a defining test case for Norway's policy of public political attribution of state-sponsored cyber operations.

Why it matters

The Storting breach showed that even small, well-resourced democracies are persistent targets for foreign intelligence services seeking insight into political deliberations. Norway's decision to name Russia publicly — and to back it with a formal PST attribution — marked a shift toward deterrence-by-disclosure among Nordic states. The incident also exposed how weak password policies and missing multi-factor authentication on a legislative email system can hand a hostile intelligence service the keys to a nation's political correspondence.