In April 2025 someone reached the remote login of a small dam in western Norway and opened its valve all the way. The dam supplies a fish hatchery, not a power plant. Nothing flooded, and the owner said plainly how it happened.
Bremanger is the rare small incident with more than one witness. A hacktivist video is a claim; here it met an owner who described the event to the press, police who examined the video, and a security service that wrote the case into its threat assessment. The effect deserves its true size: one minimum flow valve on a hatchery's dam stood fully open for just under four hours, by the owner's account, and nothing flooded.
The valve had an external login, and the owner's view is that a weak password was probably enough. The question is not how strong the password was but why a valve that needed only a schedule and a guard would answer anyone on the internet. That reading is BlastWave's analysis. The retelling did worse: the valve became a floodgate, the hatchery became energy infrastructure, and pro-Russian actors became Russia. Our own first volume did all three.
What is not known: No Norwegian authority has published how the login was reached. The owner said a weak password was probably to blame; the police said nothing on method and closed the case in October 2025 without identifying anyone. Neither PST nor Kripos has publicly named the group whose watermark is on the video, and no government document attributes the operation to the Russian state. The duration and flow are the owner's figures, not a published log. How the opening was spotted, how and by whom the valve was closed, and what it cost are undisclosed.
Recommendation
Take the path away A valve that runs on a schedule, with a guard within driving distance, does not need a login that answers the internet. Put it where strangers cannot find it.
Remove credential-only access Any remote change to discharge needs a named person, a second factor and a logged, time-boxed session. A local limit on remote opening is BlastWave's suggestion.
Let the watchers read one way Level, flow and alarms leave the dam over a one-way path, so checking on it from town never needs a door that can also open it.
Sources: PST, National Threat Assessment 2026, p. 27; NTB, 10 Jun 2025 (owner's account); Energiteknikk, 11 Jun and 14 Aug 2025; Reuters, 13 Aug 2025 (via ABC News); iLaks, 3 Oct 2025 (case closed, per NRK). Full list with links.
Soft Spots: Duration and flow are the owner's figures via the press; the weak password is the owner's “probably.” No source says who closed the valve. That the login answered the internet is BlastWave's inference.
The full record
Every claim numbered to its source. Last updated .
One valve on a fish hatchery's freshwater dam in western Norway, opened through an external login and reported plainly by its owner. What is verified, what is only reported, and what is still unknown.
Summary
On 7 April 2025, the owner of a dam at Risevatnet in Bremanger, western Norway, found that someone had remotely opened its minimum flow valve all the way. The access lasted just under four hours, by the owner's account. The dam supplies a fish hatchery, and nothing flooded. Norway's security service blamed an unnamed pro-Russian hacktivist group; nobody was charged.1,3,5,6
Timeline of the Bremanger dam intrusion
Every date is tied to a source. Press reporting appears only as evidence of what was said.
The owning company finds unauthorized access to a panel that remotely controls a valve. The minimum flow valve is opened to 100 percent; by the owner's account the access lasts just under four hours. Reuters also gives 7 April as the date.1,7
Norway's National Security Authority (NSM) and the dam safety regulator NVE are notified. The case is reported to the police and followed up by Kripos, the national criminal police.1,2
The trade journal Energiteknikk breaks the story; the wire service NTB carries it with the owner's account of the discovery, the duration and the flow.1,2
Energiteknikk's commentary reports the way in was the dam's external login, a guard reached the dam fairly quickly and found the valve fully open, the owner said a weak password was probably to blame, and there was never a flood risk.3
Energiteknikk reports that pro-Russian hackers published the break-in on Telegram.8
Energiteknikk reports PST is investigating it as the first case under the Penal Code provision on influence activity on behalf of a foreign intelligence service, in force since 1 July 2024.9,10
At the Arendalsuka festival, PST's head, Beate Gangås, points to pro-Russian cyber actors in a speech. Russia's embassy tells Reuters the claims are "unfounded and politically motivated." Reuters frames the speech as Oslo's first official attribution.4,7
Energiteknikk reports Kripos's statement that the video bears a static watermark naming a pro-Russian cybercriminal group. BleepingComputer prints a 7.2 million liter figure.11,12
PST tells NRK the prosecutors have closed the criminal cases because the investigation did not identify who was behind the intrusions.6
PST's National Threat Assessment 2026 says "a pro-Russian hacktivist group conducted a cyber operation aimed at a Norwegian dam" and calls it unsophisticated.5
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
What kind of dam was it?
A freshwater supply dam for a fish hatchery, not part of Norway's power preparedness3,6
Established (trade press)
What was opened?
One valve, the one that sets minimum flow, opened to 100 percent1
Verified (owner's account)
How long did the access last?
Just under four hours, by the owner's account. No log published1
Owner's figure
How much extra water?
497 liters a second above required minimum flow; flood calculation about 20,0001
Owner's figure
Was there a flood or damage?
No flood risk; no damage to fish or plant; no injuries3,6,7
Verified (owner and press)
How did the intruder get in?
Through the external login, probably with a weak password, in the owner's words1,3
Owner's view only
Who closed the valve?
Not stated by any source
Undisclosed
Who was behind it?
"A pro-Russian hacktivist group," per PST; not named5
Verified (PST assessment)
Did Norway attribute it to the Russian state?
No government document does. A speech and a threat assessment point to pro-Russian actors5,7
No. Case closed October 2025 without identifying anyone6
Verified (PST, via press)
Incident cost
Not published
Undisclosed
Was the Bremanger dam a hydropower dam?
No. It is a small dam built to supply fresh water to a fish hatchery, and it is not part of Norway's power preparedness. It sits at the outlet of the lake Risevatnet in Bremanger municipality, Vestland, on Norway's west coast.1,4 Energiteknikk, the trade journal that broke the story, wrote in its commentary of 11 June 2025:
"Dammen ble bygget for å sørge for ferskvann til et settefiskanlegg og er ikke en del av kraftberedskapen i Norge."
In English (BlastWave's translation): the dam was built to supply fresh water to a fish hatchery (settefiskanlegg) and is not part of Norway's power preparedness. The aquaculture publication iLaks reported in October 2025 that the lake is the water source for a post-smolt plant.6 The valve that was opened is the one that sets the minimum flow into the river Riselva: the set amount of water a dam like this has to keep running down the river below it.3
What did the intruder actually do to the dam?
One valve, the minimum flow valve, was opened all the way through the dam's remote control, and nothing flooded. On 7 April 2025 the owning company found unauthorized access to a panel that remotely controls a valve, according to the national wire service NTB, citing Energiteknikk.1 The owner's technical manager told NTB:
"Ventilen ble åpnet til 100 prosent, uten at det har noen konsekvens annet enn at det i perioden gikk 497 liter i sekundet mer enn kravet til minstevannføring"
In English: the valve was opened to 100 percent, and during that period 497 liters a second ran above the required minimum flow. NTB put the access at just under four hours ("Tilgangen varte i underkant av fire timer") and the flood calculation for the dam and river at about 20,000 liters a second.1
Energiteknikk's commentary says a guard reached the dam fairly quickly and by then the valve stood fully open, and that there was never any danger of flooding.3 The owner told iLaks there was no damage to fish or plant and no effect on production; Reuters reported no injuries.6,7
These are the owner's figures, relayed by the press. No flow log has been published. Reuters rounded them to 500 liters a second for four hours:
"500 liters (132 gallons) of water per second for four hours before the attack was detected and stopped"
The sources do not settle the sequence inside those hours. The owner found the access on its remote control panel; Energiteknikk says a guard came fairly quickly and found the valve open; Reuters says four hours passed before it was detected and stopped. No source says how or by whom the valve was closed.1,3,7
How did the intruder get into the dam's controls?
Through the dam's external login, probably with a weak password, in the owning company's own words. No authority has said how. Energiteknikk's commentary says access came through "det eksterne påloggingssystemet til dammen" (the dam's external login) and reports:
"eierselskapet sier til oss at det trolig kan være et svakt passord til påloggingen som kan ha skylden"
In English: the owning company said the cause was probably a weak password on the login. The owner's technical manager told NTB the same, that it was "trolig ... et for svakt passord" (probably a weak password).1
That is the owner's view, given to reporters, and it stays a "probably." The police have said nothing public about method, and the case was closed in October 2025 without identifying anyone.6 No malware has been reported, and PST's 2026 threat assessment calls the operation unsophisticated.5 That the login could be reached from the internet is BlastWave's inference from "external login" and "weak password," not a statement by any investigator.
Did Russia hack the Bremanger dam?
No Norwegian authority has attributed it to the Russian state or named a group. Norway's Police Security Service (PST) says a pro-Russian hacktivist group was behind it. The record builds in steps. A document seen by Energiteknikk describes the event as "dei var blitt hacka frå Russland" (they had been hacked from Russia); it does not say whose words those are.2 On 13 June 2025 the journal reported that pro-Russian hackers had published the break-in on Telegram.8 The national criminal police, Kripos, said the video bears a static watermark naming "en pro-russisk cyberkriminell gruppe" (a pro-Russian cybercriminal group), and did not say which.11
On 13 August 2025, at the Arendalsuka festival, PST's head, Beate Gangås, pointed to pro-Russian cyber actors in a speech.4,7 In Reuters' translation:
"Over the past year, we have seen a change in activity from pro-Russian cyber actors."
"The aim of this type of operation is to influence and to cause fear and chaos among the general population."
No manuscript or recording of the speech has been found, and its English renderings differ between outlets, so this page quotes Reuters' wording only. Energiteknikk reported her saying, in Norwegian, that these are methods Russia uses to influence the security situation in other countries.11 Reuters described the speech as Oslo's first official attribution; that is Reuters' framing. Russia's embassy told Reuters the claims were "unfounded and politically motivated."7 When PST put it in writing, it said:
"Operations by foreign intelligence actors can have multiple objectives. Influencing public opinion by generating unrest and attracting attention may be one. This was demonstrated in 2025, when a pro-Russian hacktivist group conducted a cyber operation aimed at a Norwegian dam. The operation was unsophisticated and had limited potential for damage, but nevertheless attracted considerable attention when the actor publicised the incident on social media."
The dam is not named in that passage. Its placement under operations by foreign intelligence actors, like the speech, points toward the Russian state; neither says it. There is no named group, sanction, charge or government attribution statement.5 Group names in circulation come from vendors and the press, and one aggregator website named a Russian military unit with no source; nothing Norwegian says that. The joint advisory AA25-343A on pro-Russia hacktivists, issued on 9 December 2025, does not mention Norway.13
What is still not known about Bremanger Dam
How the login was reached. No Norwegian authority has published a method; the owner said a weak password was "probably" to blame.1,3
Who was behind it. The police closed the case in October 2025 without identifying anyone.6
Which group's name is on the video's watermark. Neither PST nor Kripos has publicly named it.5,11
Whether the Russian state was involved. No government document attributes the operation to it.5
The measured duration and flow. The figures are the owner's; no flow log is published.1
How the opening was spotted, and how the hours divide between the owner seeing the access on its panel, the guard arriving and the valve being closed.1,3,7
How and by whom the valve was closed.
What the incident cost.
The full text of the 13 August 2025 speech. No manuscript or recording has been found, and English renderings differ.7,12
Claims about Bremanger Dam the record does not support
Widely repeated claim
What the record says
"Hackers opened the dam's floodgates and released water uncontrollably."
One valve, the minimum flow valve, was opened fully. The owner put the extra flow at 497 liters a second against a flood calculation of about 20,000, and there was never a flood risk.1,3
"Hackers seized control of the dam."
The record is one valve, reached through the dam's external login.1,3
"It was a hydropower or energy dam."
It supplies fresh water to a fish hatchery and is not part of Norway's power preparedness.3,6
"7.2 million liters of water were released."
A rate multiplied by a rounded four hours, printed as a measurement. The owner's figures are 497 liters a second above required minimum flow for just under four hours, and no flow log is published.1,12
"A default password let them in."
The owner said probably a weak password, not a default one. The police have said nothing on method.1,3,6
"Norway attributed the attack to Russia."
PST's head pointed to pro-Russian cyber actors in a speech, and PST's threat assessment names "a pro-Russian hacktivist group." Pro-Russian actors are not the Russian state; there is no government attribution statement, sanction or charge. "First official attribution" is Reuters' framing.5,7
"A named Russian military hacking unit was behind it."
One aggregator website named a Russian military unit with no source. No Norwegian authority names any group.5,11
"The valve stayed open until a guard reached the dam and closed it."
A guard reached the dam fairly quickly and found the valve fully open. No source says how or by whom it was closed.1,3,7
Including our own. Our Volume 1 Hackopedia entry, "Bremanger Dam Seizure (Norway, 2025)," filed the dam under Energy, said hackers opened a floodgate and released water uncontrollably, said "likely default password," called it an attack attributed to Russia in a paragraph about April, and printed 7.2 million liters and three Olympic pools. Our Tczew anniversary blog says "attackers manipulated valves at the Bremanger dam, an incident Oslo later attributed to Russia." Each is corrected on this page.14 We correct our own record first; it is what earns the right to correct anyone else's.
Was anyone charged over the Bremanger dam intrusion?
No. The criminal case was closed in October 2025 without identifying anyone. The intrusion was reported to the police and followed up by Kripos.1 Energiteknikk reported in June 2025 that PST was investigating it as the first case under the Penal Code provision on influence activity on behalf of a foreign intelligence service, and quoted a PST police attorney:9
"Vi har ingen straffesaker på denne bestemmelsen hos oss så langt. Dette blir den første."
The provision is section 130 of the Penal Code, "Påvirkning fra fremmed etterretning" (influence from foreign intelligence), enacted by the Storting and in force from 1 July 2024.10 That this was the first case under it is Energiteknikk's reporting of PST's attorney.
On 3 October 2025, PST police attorney Per Niklas Hafsmoe told the broadcaster NRK, as reported by iLaks:
"Etterforskingen har ikke avdekket hvilke personer som stod bak disse spesifikke datainnbruddene. Straffesakene avsluttes derfor av påtalemyndigheten som en følge av manglende opplysninger om gjerningsperson"
In English: the prosecutors ended the criminal cases because the investigation had not identified the perpetrators.6
BlastWave analysis: a valve that answered the internet
Analysis, not a disclosed fact
Bremanger is the rare small incident with more than one witness. A hacktivist video of a control screen is a claim. Here the claim met an owner who described the event to a trade journal in plain words, a criminal police service that examined the video, and a security service that later wrote the case into its national threat assessment.1,5,11 That puts it on the top rung of this volume's consequence ladder: OT command execution with a corroborated physical effect, and nobody disputes this one. It is also why the effect deserves its true size: one minimum flow valve on a hatchery's freshwater dam stood fully open for just under four hours, by the owner's account, and nothing flooded.
The mechanism is the plainest in the book. The valve had an external login, and the owner's own view is that a weak password was probably enough. The question the architecture has to answer is not how strong the password was but why a valve that only ever needed a schedule and a guard would answer anyone on the internet who asked. That reading is BlastWave's analysis, not a disclosed finding. The owner comes out of this well: a guard reached the dam fairly quickly, the incident went to the national security authority, the dam safety regulator and the police, and the company told a reporter "probably a weak password" rather than nothing. A person who can drive to the valve is the fallback every remote site needs, though the record does not say who closed it.
Podcast: “The Orchard Timer” (9:34). Joe Baxter and Cam Cullen on why the valve's open login, not the strength of its password, is the real story.
Video: Bremanger Dam Short (60 to 90 seconds).
Frequently asked questions
What happened at the Bremanger dam in Norway?
On 7 April 2025, the company that owns a small dam at the outlet of Risevatnet in Bremanger, western Norway, found unauthorized access to the panel that remotely controls its minimum flow valve. The valve had been opened all the way. By the owner's account, reported by NTB in June 2025, the access lasted just under four hours. The dam supplies a fish hatchery, nothing flooded, and nobody was hurt.
Was the Bremanger dam a hydropower dam?
No. The trade journal Energiteknikk reported on 11 June 2025 that the dam was built to supply fresh water to a fish hatchery and is not part of Norway's power preparedness. The valve that was opened sets the minimum flow into the river Riselva. Many retellings, including BlastWave's own first Hackopedia volume, wrongly described it as energy infrastructure or a floodgate.
Did Russia hack the Norwegian dam?
No Norwegian authority has attributed it to the Russian state. PST's head, Beate Gangås, pointed to pro-Russian cyber actors in a speech on 13 August 2025, and PST's National Threat Assessment 2026 says "a pro-Russian hacktivist group" carried out the operation. No group has been publicly named, and no sanction, charge or government attribution statement exists. Russia's embassy called the claims unfounded and politically motivated, according to Reuters.
How did hackers get into the Bremanger dam?
Through the dam's external login. The owning company told Energiteknikk and NTB in June 2025 that a weak password was probably to blame. That is the owner's view, not a finding: the police have said nothing public about method. No malware has been reported, and PST's 2026 threat assessment called the operation unsophisticated, with limited potential for damage.
How much water was released at Bremanger, and was there a flood?
The owner's technical manager told NTB the valve let 497 liters a second more than the required minimum flow, against a flood calculation of about 20,000 liters a second, and NTB, from the owner's account, put the access at just under four hours. Energiteknikk said there was never any danger of flooding. The widely quoted 7.2 million liters is a multiplication, not a measurement, and no flow log has been published.
Who closed the valve at the Bremanger dam?
No source says. Energiteknikk reported on 11 June 2025 that a guard reached the dam fairly quickly and found the valve fully open. The owner found the access on its remote control panel, and Reuters wrote that water flowed for four hours before the attack was detected and stopped. How and by whom the valve was closed is undisclosed.
Was anyone charged over the Bremanger dam hack?
No. PST investigated it as the first case under Norway's Penal Code provision on influence activity on behalf of a foreign intelligence service, in force since 1 July 2024, according to Energiteknikk. On 3 October 2025 a PST police attorney told NRK the prosecutors had closed the criminal cases because the investigation had not identified who was behind the intrusions.
Primary sources are the Norwegian Police Security Service's own threat assessment and the Norwegian parliament's enactment of the law the case was investigated under. The owner, the police and the security service otherwise spoke through the press, so the owner's account is cited from the wire and trade press that carried it, and press is otherwise cited only as evidence of what was said. Norwegian quotations are BlastWave's translations unless marked as Reuters'.
PressNTB, "Hackere åpnet ventil på fullt ved dam-anlegg i Bremanger" (Hackers opened valve fully at dam facility in Bremanger), 10 June 2025, citing Energiteknikk; read through Bergens Tidende's republication. Carries the owner's account: discovery date, duration, flow and the owner's "probably" on the password.
PressEnergiteknikk, Øyvind Zambrano Lie and Trygve Mellvang Tomren-Berg, "Hackere åpnet ventil på fullt ved dam-anlegg" (Hackers opened valve fully at dam facility), 10 June 2025, updated 12 June 2025. Paywalled; read in its open text.
PressEnergiteknikk, Trygve Mellvang Tomren-Berg, "It's the password, stupid" (commentary), 11 June 2025. Source for the external login, the guard, the owner's "probably," the hatchery and the absence of flood risk.
PressVG, Alf Bjarne Johnsen, Anne Sofie Rønnfeldt and Gøran Bohlin, "PST-sjefen mener pro-russiske hackere sto bak cyberangrepet mot damanlegget i Bremanger" (PST chief believes pro-Russian hackers were behind the cyberattack on the dam facility in Bremanger), 13 August 2025.
GovernmentPolitiets sikkerhetstjeneste (Norwegian Police Security Service, PST), National Threat Assessment 2026 (English edition of Nasjonal trusselvurdering 2026), February 2026, p. 27, "Influence operations." The dam is not named. PDF · Norwegian edition (PDF)
PressiLaks, "Pro-russiske hackere åpnet vannkilden til postsmoltanlegg. Nå har PST henlagt saken" (Pro-Russian hackers opened the water source for a post-smolt plant. Now PST has closed the case), 3 October 2025. Carries PST's statement to NRK on the closure and the owner's account of the effect on the hatchery. ilaks.no
PressReuters, Nerijus Adomaitis, "Norway spy chief blames Russian hackers for dam sabotage in April," 13 August 2025, read through its republications by ABC News (Australia) and Insurance Journal, 14 August 2025. Cited for its English translation of the speech, the embassy's response and its own figures and framing.
PressEnergiteknikk, Trygve Mellvang Tomren-Berg, "Pro-russiske hackere publiserte dam-innbrudd på Telegram" (Pro-Russian hackers published dam break-in on Telegram), 13 June 2025. Paywalled; headline and standfirst only.
PressEnergiteknikk, Trygve Mellvang Tomren-Berg, "Dam-hackingen første sak etter ny lovparagraf" (The dam hacking is the first case under a new legal provision), 24 June 2025.
GovernmentStortinget (Norwegian parliament), Lovvedtak 62 (2023-2024), "Vedtak til lov om endringer i straffeloven mv. (påvirkning fra fremmed etterretning)" (Enactment of a law amending the Penal Code, influence from foreign intelligence): new section 130, in force 1 July 2024. stortinget.no · PDF
PressEnergiteknikk, Trygve Mellvang Tomren-Berg, "Russland trapper opp retorikken etter dam-hacking" (Russia steps up rhetoric after dam hacking), 14 August 2025. Carries the Kripos statement on the video's watermark.
PressBleepingComputer, "Pro-Russian hackers blamed for water dam sabotage in Norway," 14 August 2025. Cited as evidence of what was said, including the 7.2 million liter figure. bleepingcomputer.com
FederalCISA, FBI, NSA and partners, Joint Cybersecurity Advisory AA25-343A, "Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure," 9 December 2025. Cited for what it does not say: it does not mention Norway or a dam. PDF
CompanyBlastWave, Hackopedia Volume 1, "Bremanger Dam Seizure (Norway, 2025)," ebook entry and live page at hackopedia.blastwave.com; and BlastWave's Tczew anniversary blog, blastwave.com, live since 10 August 2026. Cited as the errors being corrected.
Cite this page
BlastWave. “Bremanger Dam Intrusion (2025): What Is Verified.” Hackopedia, Volume 2, FILE 018. Last verified 28 September 2026. https://hackopedia.blastwave.com/water/bremanger-dam-2025/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 018 in Hackopedia Volume 2, in the Water edition.
28 Sep 2026
Hand-check and consistency re-check. The law PST investigated under was checked against the Norwegian parliament's enactment (section 130, in force 1 July 2024). The security chief's speech and the trade journal's commentary on the guard were sought at source and could not be obtained; both remain attributed to the press that carried them.
26 Sep 2026
Full validation. The duration and flow were re-attributed to the owner's own account (just under four hours; 497 liters a second above required minimum flow), and 7 April confirmed as the owner's discovery date. A statement that the valve stayed open until a guard arrived was withdrawn as unsupported. Added: the October 2025 closure of the criminal case, the owner's report of no damage to fish or plant, and a check that advisory AA25-343A does not mention Norway.
24 Sep 2026
Volume 2 entry built from primary sources. Corrected the Volume 1 errors: floodgate, energy infrastructure, "likely default password," attribution to Russia, and 7.2 million liters.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
Bremanger, Norway
21
Print edition · Volume 2File 018 as a printable pageThe same record, laid out for print: one page, US Letter, PDF.Download PDF · 245 KB