Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
NO

Ransomware attacks in Norway

57 organisations in Norway have been listed on ransomware leak sites, ranking #45 worldwide. Updated .

Victims
57
0.2% of global total
Global rank
#45
of 180 countries
Active groups
35
Most: Medusa
Sectors
14
Most: Business Services

ThreatAI analysis

Compiled from this database and the ransomware.live profiles of the groups active in Norway. Figures are computed from the tracked records, not inferred.

Norway experiences ransomware activity with 57 recorded victims among the top countries ranked number 45 globally, primarily targeting Technology and Manufacturing sectors by Medusa, Ransomhub, and Settra threat groups.

Norway in the global picture

Norway accounts for 57 of the ransomware disclosures tracked here, ranking #45 worldwide and making up 0.2% of the global total. The sectors listed most often are Business Services, Technology, Manufacturing.

Who is most active in Norway

Medusa — 6 victims in Norway. Ransomhub — 4 victims in Norway. The group emerged in mid-February 2024 and has already listed several organizations as alleged victims of their attacks, resulting from extortion through encryption and data leaks. Settra — 3 victims in Norway.

Ransomware threat profile: Norway

Norway ranks #45 worldwide for ransomware disclosures, with 57 victims in this database — 0.2% of the global total. The groups listing the most organisations here are Medusa, Ransomhub and Settra.

The most frequently listed industries in Norway are Business Services, Technology, Manufacturing. Healthcare is especially exposed: an outage at a hospital or clinic can put patients at risk, which raises the pressure to pay quickly.

The volume reflects Norway's integration into the global economy and the reach of ransomware operations that target organisations of every size. Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.

Victims in Norway 57

Organization Disclosed
konsis.no
Settra
Laerdal
Everest
vestfrostsolutions.com
Settra
vestfrostsolutions.com
Settra
Aquasea
Thegentlemen
JOSO
Deadlock
Lørenskog kommune
Cmdorganization
fasadeconsult.no
M3rx
Alpha IT
Pear
Nordfjord Hotell
Nova
Telia Norge AS
Payoutsking
Apply Capnor
Dragonforce
Evaluate a Norstella company
Everest
T a Solberg
Play
Demanor
Ailock
wilhelmsen.com
Lockbit5
DCSNORWAY.COM
Clop
BR-ALSETH.NO
Clop
arko.no
Devman
Tunad
Arcusmedia
ksubsea-group
Direwolf
Viking Automation
Everest
norsk.global
Qilin
coBuilder
Dragonforce
narvikhavn.no
Teamxxx
Norgeshus
Sarcoma
Datatrykk
Nightspire
Lars Myhre Ostfold AS
Nightspire
ARRCO LSM
Nova
Acos Favorit
Rhysida
ARRCO LSM
Ralord
Bjørklund
Termite
lofotenseafood.com
Lynx
Accelerator
Dragonforce
Fligno
Fog
www.avantit.no
Babuk2
Ship Services
Akira
jergenspiping.com
Ransomhub
sundt.com
Ransomhub
Astero
Meow
Østerås Bygg
Medusa
Istrail
Medusa
Isola
Medusa
Røros Hotell
Medusa
Hairstore
Medusa
Fritzøe Engros
Medusa
seaglesafety.com
Eldorado
NOBI AS
Meow
Total Revisjon DA
Arcusmedia
www.avantit.no
Ransomhub
Sigmund Espeland AS
8base
Fifisystems
Spacebears
eurosko.com
Lockbit3
Avant IT Norway
Ransomhub
Nbbl
8base
hotelcontinental.no
Qilin
Ito Pallpack Gruppen
Akira

Frequently asked questions

How many ransomware attacks have occurred in Norway?

Norway has recorded 57 ransomware victim disclosures in this database, ranking #45 globally. This represents 0.2% of all tracked ransomware attacks worldwide.

Which ransomware groups target Norway?

The ransomware groups most active in Norway are Medusa, Ransomhub, Settra, Everest. These groups collectively account for the majority of victim disclosures attributed to Norway.

Which industries are most targeted by ransomware in Norway?

In Norway, the most frequently targeted sectors are Business Services, Technology, Manufacturing. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.

How does Norway rank globally for ransomware attacks?

Norway ranks #45 globally for ransomware attacks with 57 victim disclosures, representing 0.2% of the worldwide total of 23,585 tracked victims.

How can organisations in Norway protect against ransomware?

Organisations in Norway should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Norway is also recommended.