Klaksvik faces ongoing IT security concerns after cyberattack in Denmark

The ongoing issues regarding the lack of IT security in the municipality of Klaksvik have increasingly highlighted concerns within the local government itself.

Recent audit reports indicate that the municipality’s IT security policy was inadequate when it fell victim to a cyberattack in September, which nearly paralyzed the entire municipality, leading to the payment of around 800,000 Danish kroner in ransom.

As recent as this spring, or early summer, the auditor confirmed that the development of the IT security policy remains delayed. Furthermore, the auditor noted that risk assessments and contingency plans are still lacking. However, there are plans to address these issues once the security policy is implemented.

In the first half of 2023, Klaksvik’s municipality decided to take on the responsibility of ensuring the safety of its IT systems—both protecting against attacks and creating secure backups—tasks that had previously been handled by the IT company NEMA.

This decision resulted in NEMA informing all its business clients about the security situation on October 7—just four days after Klaksvik held a press conference regarding the cyberattack. In its communication, NEMA emphasized that the municipality, which had recently been attacked, was not under NEMA’s hosting, as it has its own hosting and management. This means that despite using NEMA’s systems, the company has no influence over the municipality’s security.

To date, Klaksvik has not commented on its collaboration with NEMA concerning IT security.

In response to the extensive cyberattack, a company specializing in IT security has been engaged to investigate the matter, and the city council will later decide whether to initiate an external review.

Additionally, the city council has requested 3.8 million Danish kroner for additional funds to cover expenses resulting from the cyberattack. According to Kringvarpið, discussions regarding these funds have taken place behind closed doors, in meetings inaccessible to the public.