Five Norwegian Cases

The Loss Is Already Counted

Deception is not a future risk in Norway. It is a measured cost. Finanstilsynet, the financial regulator, reported losses from social engineering of NOK 360 million in the first half of 2024,¹ and NOK 307 million in the second half.² Taken together, that is NOK 667 million in a single year, the sum of two published half-year figures.

It is a national figure across the financial system, not a statistic about any one firm or profession, and it does not claim that every loss began with a stolen password. Attacks built on deception are already taking very large sums out of Norwegian organizations, every year.

NOK 667 million in a single year. The sum of two published figures, not an estimate.

When the Regulator Looked at the Login

The clearest Norwegian example is not a breach story. It is a regulator's decision. After the Storting, the national parliament, was breached in 2020, Datatilsynet imposed an administrative fine of NOK 2 million.³ The reason matters more than the amount. In its 2022 decision, Datatilsynet was explicit about the control that had failed, emphasizing that the Storting "did not have two-factor authentication or equivalent effective security measures."³ The breach ran through email accounts, and that gap is what left them open.

This is the regulator's own published decision, tied to a named institution and a defined sanction. The lesson is narrow. Weak authentication can become a sanctionable deficiency. It does not follow that every organization without modern authentication faces the same fine. It does follow that, in the right facts, the quality of a login is a governance question and not only an IT one.

What Failure Costs

Two Norwegian cases show the range of what a serious incident can cost. At the large end, Norsk Hydro has said its 2019 cyberattack led to total costs of around NOK 800 million.⁴ At a smaller and more ordinary scale, Teknisk Ukeblad reported that an attack on AKVA group cost about NOK 49.7 million, in 2021.⁵

In neither case does the public record cleanly establish that stolen credentials were the way in. The Hydro attack, a LockerGoga ransomware infection documented at the time by Recorded Future⁶ and Industrial Cyber,⁷ has never had its initial access path settled in public. So these are not proof that a password failure caused the damage. They are proof of something else. Norwegian cyber incidents can become very expensive, at both the head-turning scale and the quietly realistic one. When the downside is that large, closing the common and well-understood attack paths is simply rational.

The Trusted Email

The Nordic Choice Hotels incident points at a different surface. The hotel group was hit by Conti ransomware, as reported by CyberEnso,⁸ and a Visma case study describes how it began: an employee opened an attachment that appeared to come from a trusted partner.⁹

There is no high-confidence public figure for the loss, and this is not a clean public example of stolen credentials used to take over an account. The value of the case is narrower. It shows how easily an ordinary, trusted business workflow can be turned into a way in, even at a large and capable company. Identity protection has to sit inside a wider guard against deception, not stand alone as a single fix.

What These Cases Support, and What They Do Not

Each case carries a single point. The Storting decision shows that weak authentication can become a regulatory problem. The Finanstilsynet figures show that deception-driven loss in Norway is already very large. Hydro and AKVA group show the cost of a serious incident. Nordic Choice shows that trusted communication remains a practical way in.

What they do not support is the easy claim that every major incident began with a stolen password and would have been stopped by one piece of technology. The public evidence does not show that. Phishing-resistant authentication removes one important and common class of failure from an environment where identity, email, and trust sit at the center.

It removes one important class of failure. It does not pretend to remove them all.

The Stronger Control

Not all multi-factor authentication is equal. NSM, the national security authority, draws a line between phishing-resistant multi-factor authentication and weaker forms, and recommends the stronger category against phishing and account takeover.¹⁰ That distinction is the whole point. The phishing-resistant kind is the one that holds when someone is actively trying to trick a person.

The practical case is better than many firms expect. Microsoft has reported that passkey sign-ins are "eight times faster than a password and multifactor authentication,"¹¹ which means the stronger method can also be the easier one. And Norwegians are not being asked to adopt something foreign. The FIDO Alliance describes BankID, used by about 4.7 million people, roughly 97 percent of the country, as part of the same move toward passkey-based authentication.¹²