INCIDENT REPORT · CP-2025-002

Bremanger dam valve manipulation

L2 · GUARDEDCONFIRMED

Intruders accessed the control system of a dam at Lake Risevatnet in Bremanger, western Norway, and opened a discharge valve to 100% for about four hours.

Incident ID: CP-2025-002
Incident date: 07 APR 2025
Detection date: 07 APR 2025
Affected countries: Norway
Plotted location: Svelgen (Bremanger), Norway (Approximate location of affected dam near Svelgen)
Threat classification: Level 2 — GUARDED
Classification rationale: Physical process manipulation at critical infrastructure, but with limited real-world consequences.
Attack type: Infrastructure Compromise
Nature: Malicious activity
Attack vector: Unauthorized access to a web-accessible remote control panel, reportedly protected by a weak password
Sectors: Water, Energy
Critical infrastructure: Yes
Organizations affected: Breivika Eigedom (dam owner)
Operational consequences: Water outflow increased by roughly 500 litres per second for nearly four hours before detection; no casualties or damage were reported. Norway's PST later publicly attributed the operation to pro-Russian hackers.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by Norway's Police Security Service (PST) to pro-Russian hackers; Russia's embassy rejected the claim

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Bremanger dam valve manipulation

L2 · GUARDEDCONFIRMED

Intruders accessed the control system of a dam at Lake Risevatnet in Bremanger, western Norway, and opened a discharge valve to 100% for about four hours.

Incident ID

CP-2025-002

Incident date

07 APR 2025

Detection date

07 APR 2025

Affected countries

Norway

Plotted location

Svelgen (Bremanger), Norway (Approximate location of affected dam near Svelgen)

Threat classification

Level 2 — GUARDED

Classification rationale

Physical process manipulation at critical infrastructure, but with limited real-world consequences.

Attack type

Infrastructure Compromise

Nature

Malicious activity

Attack vector

Unauthorized access to a web-accessible remote control panel, reportedly protected by a weak password

Sectors

Water, Energy

Critical infrastructure

Yes

Organizations affected

Breivika Eigedom (dam owner)

Operational consequences

Water outflow increased by roughly 500 litres per second for nearly four hours before detection; no casualties or damage were reported. Norway's PST later publicly attributed the operation to pro-Russian hackers.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by Norway's Police Security Service (PST) to pro-Russian hackers; Russia's embassy rejected the claim