Klaksvík cyber security cleared after 2024 attack

Klaksvík Municipality has received final confirmation from the Data Protection Authority that its work following a 2024 cyberattack is satisfactory, Kringvarp Føroya reports.

The authority said it has no further comments on the case, according to the municipality.

The cyberattack

Klaksvík Municipality submitted an initial notification of a security breach to the Data Protection Authority on September 24, 2024. In a more detailed report that November, the municipality said hackers had gained access to its IT systems and encrypted them.

The hackers had reportedly been inside the systems from September 8 until September 28, 2024, when the entire network was shut down.

The Data Protection Authority concluded that the municipality had seriously violated Section 46 of the Data Protection Act through gross negligence. It issued a serious reprimand and ordered the municipality to carry out a risk assessment.

Case closed

Because the municipality had upgraded its IT security after the breach, it was instructed to assess, on the basis of the risk assessment, whether the upgrades were sufficient or whether further improvements were needed.

Klaksvík Municipality said it had assessed its existing IT security, completed a detailed risk assessment and updated its security framework. The municipality welcomed the closure of the case.