In April 2025, Norwegian authorities confirmed that pro-Russian hackers gained brief control over a hydropower dam in southwestern Norway, marking a significant escalation in cyber threats to critical European infrastructure.
What Happened?
On April 7, 2025, hackers managed to infiltrate the dam’s digital control system in Bremanger, western Norway. The attackers remotely opened a flood gate, releasing approximately 500 litres of water per second for four hours before staff intervened and stopped the breach. No injuries were reported, but the incident highlighted vulnerabilities in Norway’s energy infrastructure, which relies heavily on hydropower.
A video showing the dam’s control panel—and symbols linked to a pro-Russian cybercriminal group—was posted to Telegram during the attack, underscoring the sabotage’s deliberate demonstration effect.
Attribution and Motives
The Norwegian Police Security Service (PST) director, Beate Gangås, disclosed the attack’s details in August 2025. Gangås stated that over the past year, pro-Russian cyber actors have notably shifted tactics, increasingly targeting Western critical infrastructure. She emphasized that Russia uses hybrid methods—including sabotage and influence campaigns—to create unrest and demonstrate capabilities, rather than carry out overt acts of war.
Gangås elaborated, “The objective of these operations is to instil fear and chaos among the general populace,” and warned that such operations are likely to grow across Europe.
Broader Threats
The PST highlighted that Norway, a NATO member and Europe’s largest gas supplier, remains a target for Russian hybrid warfare. The attack on the dam is one of more than 70 documented disruptions across Europe attributed to Russia since the invasion of Ukraine, ranging from cyberattacks to physical sabotage.
Political and Security Responses
Norwegian authorities publicly attributed the incident to Russian actors to warn citizens and deter further assaults. Intelligence officials stressed the importance of preparedness and resilience against future attacks targeting critical infrastructure.
Meanwhile, the Russian embassy in Oslo dismissed the allegations as “politically motivated” and denied substantiating evidence of Russian sabotage.
Key Takeaways
- Incident Date: April 7, 2025.
- Location: Dam in Bremanger, western Norway.
- Attack Details: Hackers opened floodgates, releasing water for four hours.
- Perpetrators: Pro-Russian hackers, according to Norwegian authorities.
- Broader Context: Part of a wider pattern of Russian hybrid attacks targeting European infrastructure.
This event highlights the rising threat that state-sponsored cyber operations pose to essential infrastructure in Europe and the need for greater cybersecurity and rapid response measures.